Interesting read on Russia's 2017 cyber-attack against Ukraine

[sgt_zim]

From Wired magazine. It's a little long, but not technical at all. This is what keeps me up at night because this is the sort of business I get paid to protect my employer (and our customers) from.

https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/

 

[sgt_zim]

And in case you think I may be given over to hyperbole on the "keeping me up thing," I bolted up out of the blue this morning at about 0150 with a solution to a problem I had discovered last Friday and had stewed on over the holiday weekend. Problem solved and solution deployed by about 0600.

 

[Hogpatrol]

Makes one wonder the scale of incompetence in the affected IT departments. Sort of like if you don't get vaccinated you deserve to get infected. My question is were there backups and if not, why not?
On another note, I'm certain western governments are engaged in the same sort of shenanigans. Stutnet comes to mind.

 

[sgt_zim]

To be fair to IT departments, they're expected to keep the lights on. Security interferes with that. I have 4 different IT teams to deal with, all in the same company. And most of the time, I get the impression they think we're just FOS. It has taken us almost 3 years to get them all on board with regular patching, and we're better than most. But we still suck at it.

Most companies do not back up PCs because it's just too expensive, and it really can eat a lot of bandwidth if poorly implemented. When you're a global company like Maersk, the problem is compounded. We have offices in the US, EMEA, and APAC. Those things are just expensive challenges.

We have fairly strict rules around introducing new software into the environment. Not strict enough for my tastes, but we are slowly turning the screws down.

I own 100% of the endpoint protection tools (3 different ones) as well as network scanning for my employer. If I could triple the labor budget for patch management, I'd happily cut back on what we spend on endpoint protection.

FWIW, there isn't a guy on this board who hasn't done business with our customers, and my biggest fear is that as a vendor of these kinds of customers, we may find ourselves in the cross-hairs, similar to what happened to Target a couple years ago.

 

[Hogpatrol]

Agree we are all somewhat naked when it comes to a well planned attack. I have to laugh when I read the so called privacy policies of companies I deal with. From this chair, even for someone who has never used and never will use a computer, privacy doesn't exist.