What's the point of primary and secondary backups if they can be accessed with the same credentials on the same network
this post was submitted on 24 Aug 2023
239 points (99.6% liked)
Technology
34988 readers
376 users here now
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
founded 5 years ago
MODERATORS
They weren't normally on the same network, but were accidentally put on the same network during migration.
Time and time again, data hosting providers are proving that local backups not connected to the internet are way better than storing in the cloud.
The 3-2-1 backup strategy: "Three copies are made of the data to be protected, the copies are stored on two different types of storage media and one copy of the data is sent off site."
How would that work in practice? 1 medium offsite, and 2 mediums on-premises?
Exactly.
This is the way.
Any redundant backup strategy uses both. They both have inherent data loss risks. Local backups are great, but unless you store them in a bunker they are still at risk to fire, theft, vandalism and natural disasters. A good backup strategy stores copies in at least three locations. Local, off-site and the cloud. Off-site backups are backups you can physically retrieve. Like tapes stored in a vault in another city.
Now that you mention fucking incompetence, I need to verify my 3-2-1 backup strategy is correctly implemented. Thanks for the reminder, CloudNordic and AzeroCloud!
They had one job
People literally pay these guys to not screw up this one thing.
Danish hosting firms CloudNordic and AzeroCloud have suffered ransomware attacks, causing the loss of the majority of customer data and forcing the hosting providers to shut down all systems, including websites, email, and customer sites.
Other people's computers. Never forget.
I feel really bad for everyone involved - customers and staff. The human cost in this is huge.
Yes, there's a lot of criticism of backup strategies here, but I bet most of us who deal with this professionally have knowledge of systems that would also be vulnerable to malicious attack, and that's only the shortcomings we know about. Audits and pentesting are great, but not infallable and one tiny mistake can expose everything. If we were all as good as we think we are, ransomware wouldn't be a thing.
I think that people generally overestimate how much money tech companies like this one actually make. Their profits are tiny. A lot of the time, tech companies run on investment money, and can't actually turn a profit. They wait for the big acquisition or IPO payday. So if you think you're actually gonna get 100k off them, good luck. Sometimes they're barely keeping the lights on.
Put all the data in the cloud, they said. It will all be save and handled by professionals!
That's what you call an epic blunder.
It is a company destroying blunder.
I think they're aware of that
Martin Haslund Johansson, the director of Azerocloud and CloudNordic, stated that he does not expect customers to be left with them when the recovery is finally completed.
The customers are already lost:
-
pay the expensive ransom, if the bad actor gives them the decryption key, customers are relieved but still pissed, will take the data and move to somewhere else with a big FO. Go out of business.
-
don't pay the ransom, customers are pissed and move to somewhere else with a big FO. Go out of business.
If you fuck up that badly you shouldn't be allowed to operate in that industry.
Problem is that you have to work in the industry to fuck up that badly.
They're a small company, they'll probably just go bankrupt.
I wonder why they can't/won't pay.