Re: Can somebody explain these ransomwear attacks?

[Karl Auer <kauer () biplane com au>]

On Fri, 2021-06-25 at 10:05 -0400, Tom Beecher wrote:
> Everything can be broken, and nothing will ever be 100% secure. If
> you strive to make sure the cost to break in is massively larger than
> the value of what could be extracted, you'll generally be ahead of
> the game.

Easy to say.

IMHO the only workable long-term defence is heterogeneity - supported
by distribution, redundancy and just taking the simple things
seriously.

Business has spent the last few decades discarding heterogeneity and
the bigger they are, the more comprehensively they have discarded it.
Companies that are floor to ceiling and wall to wall Windows.
Centralised updates, centralised networking, centralised storage,
centralised ops teams, and (typically) a culture of sharing. A
relentless prioritising of convenience over security. For goodness
sake, even the NSA had the attitude that "if you are this side of the
drawbridge you must be OK"!

We need to start building systems that are not seamless, that are not
highly interchangeable, that are not fully interconnected, and we have
to include our human systems in that approach.

Regards, K.

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (kauer () biplane com au)
http://www.biplane.com.au/kauer