Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Lake City Employee Fired Following Ransom Payment
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
tdsan
50%
50%
tdsan,
 User Rank: Ninja
7/8/2019 | 4:20:01 PM
RE: Lake City Employee Fired Following Ransom Payment
I agree with you, I was thinking could there be a better way to resolve this issue.

Think about this, we have implemented software that takes an image of a 50-70GB HD (running on NVMe and USB 3.1) where we were able to image the system in about 5-8 minutes. We then took the NVMe disk with the iso for the imaging startup, then booted up the iso (started the application or in certain instances, we would leave it running) in the cloud. We then would point the software to the data iso and recreate the server using this imaging software, cloud, virtual machine or physical machine - minutes to restore) without ever leaving our desk, we pointed the ELB, F5 or Citrix Netscaler to this virtual cloud machine and we were back up and running.

For one-offs, I do think your solution worked great, but if the client is in another state, then that may be somewhat difficult; especially if they live states over (maybe FedEx would work), but it was just a thought.

T
REISEN1955
50%
50%
REISEN1955,
 User Rank: Ninja
7/8/2019 | 3:08:11 PM
RE: Lake City Employee Fired Following Ransom Payment
AND a very good thought - a wide range of alternative technical guidelines of course - the main thing is that a backup and restore scenario DOES WORK if well thought out and tested well in advance.  At 2am, when restoring a server, one is not THINKING right so testing allows familiarity and documentation to be compiled.  And FAR better than paying ransom.
tdsan
50%
50%
tdsan,
 User Rank: Ninja
7/5/2019 | 8:56:58 PM
RE: Lake City Employee Fired Following Ransom Payment
Nice, would you consider putting the server (Web, DB) in the cloud and replicate the server ever so many hours, this could be an option when performing the recovery task. Just a thought.

VMware DR Design Scheme
bwilkes8@gmail.com
50%
50%
[email protected],
 User Rank: Moderator
7/3/2019 | 10:53:00 AM
RE: Lake City Employee Fired Following Ransom Payment
Sweet!!!!
REISEN1955
50%
50%
REISEN1955,
 User Rank: Ninja
7/3/2019 | 10:32:57 AM
RE: Lake City Employee Fired Following Ransom Payment
THANKS - i know from experience.  In 2014 before moving to Georgia, I supported small and local businesses and other entities.  One 501C3 museum was hit by Cryptolocker in January - just like that, server gone and all data encrypted.  I had a dedicated system for each client with tested backup and restore protocols so I picked the Dell computer up - put it into car and drove to my client.  System had SAME NAME as server so all data instantly available when I turned server down.  Only active directory was not available of course.

I then restored data to the server offline, and in 3 hours had 98% restoration of data - only one computer lost the desktop.  NOT BAD indeed. 
bwilkes8@gmail.com
50%
50%
[email protected],
 User Rank: Moderator
7/3/2019 | 10:04:31 AM
RE: Lake City Employee Fired Following Ransom Payment
Having previously worked at a company where we were hit with ransonware, before I was tasked with backups, I can say you do have a vaild point.
REISEN1955
50%
50%
REISEN1955,
 User Rank: Ninja
7/3/2019 | 9:45:56 AM
RE: Lake City Employee Fired Following Ransom Payment
EVER notice that in every single one of the ransomware events posted on this page, NO ONE EVER use a backup and restore option.  REBUILD EVERYTHING is a waste of effort.  I suspect, though, that NOBODY HAS A BACKUP AND RESTORE PLAN in the first place. 
bwilkes8@gmail.com
50%
50%
[email protected],
 User Rank: Moderator
7/3/2019 | 9:41:16 AM
RE: Lake City Employee Fired Following Ransom Payment
1. Firing the Director is an interesting call.  The Director possesses the institutional knowledge necessary to facilitate a restructuring.

2. The Mayor is going to be rich once he incorporate the layers of security necessary for this to never happen again.

3. It's interesting that recovery from backup would cost more than paying the ransom.  Hopefully they're relooking their backup solution and periodical test procedures as well.
iani540
50%
50%
iani540,
 User Rank: Apprentice
7/2/2019 | 8:18:38 PM
Unintelligible grammar
What does "advised a more cost-approach to retrieve the key." mean? Did you mean "cost-effective approach"?  If so, what exactly did that involve? A combination of bad proof-reading and lack of information leave us with no information about who was fired, and what for.
paul.mcaninch@btlaw.com
50%
50%
[email protected],
 User Rank: Apprentice
7/2/2019 | 3:44:38 PM
Good Luck
Lake City mayor Stephen Witt says city manager Joe Helfenberg made the decision to terminate an employee. Helfenberg is revamping its entire IT department to overcome the incident and set up a system to ensure it doesn't happen again. 

 

I wish him a lot of luck.  If he really can "set up a system to ensure it doesn't happen again." he's going to be a rich man.
Page 1 / 2   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Are You One COVID-19 Test Away From a Cybersecurity Disaster?
Alan Brill, Senior Managing Director, Cyber Risk Practice, Kroll,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5144
PUBLISHED: 2020-10-28
SonicWall Global VPN client version 4.10.4.0314 and earlier allows unprivileged windows user to elevate privileges to SYSTEM through loaded process hijacking vulnerability.
CVE-2020-5145
PUBLISHED: 2020-10-28
SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful exploitation could lead to remote code execution in the target system.
CVE-2020-27956
PUBLISHED: 2020-10-28
An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=manage_car because .php files can be uploaded to admin/assets/uploads/ (under the web root).
CVE-2020-27957
PUBLISHED: 2020-10-28
The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created within MediaWiki, their names or titles could be manipulated to generate stored XSS within the RandomGameUnit extension.
CVE-2020-16140
PUBLISHED: 2020-10-27
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.