Hacker News Reader

Comment by FlyMoreRockets | Hacker News Reader

Offline backups have been a thing for decades. Why is this not standard practice? Especially for a technology company like Garmin. It can't be about cost savings, businesses still pay for insurance and security systems. For that matter, offsite backups should also be saved in case of fires, floods, tornadoes, theft, etc...

View on HN

Offline backups are not a complete solution. What if your backups are infected with the virus? Even if the backups are uninfected, your IT department has to manually scrap and rebuild all your computers from data centers to the warehouse to the receptionist. And in the meantime, like the article described, you have to pay your employees and suppliers and continue to ship products to customers.

Wired did a phenomenal article on the Maersk attack https://www.wired.com/story/notpetya-cyberattack-ukraine-rus... company I worked for was affected as we had shipping containers on the water at the time and it was chaos but they recovered.

An important part of any backup strategy is testing your backups on a regular basis. Perhaps it could even be automated...

I think the point here is that it's not as trivial as having an offline copy of your SQL DB or whatever. If the ransomware has encrypted a huge chunk of your infra the chances are that you no longer have anything to restore the backup to — maybe your configurations are encrypted, your DB hosts aren't up, user accounts etc are missing. Assuming that only user data is affected and can be easily restored likely falls very short of the full picture. I expect the folks at Garmin are faced with an infrastructure that looks like a grenade fell into it.

Backup price for 8TB is cheap enough. Backup price for 8PT does not scale well.

I don’t know how much data Garmin has company wide. But it’s a lot different for me to consider offline backups as a simple service than a company this size and complexity.

There are plenty of companies that can backup 8PB of data from a wide variety of sources for you, and make it a relatively staitforward task to interegrate with them.

There is complexity, yes, but it's mostly a solved problem.

Disclaimer: I work for one.

The easiest way to back up 8PiB of business critical data is to be a business with a need for exabytes of non-business-critical data.

I think the people who are the worst off have petabytes of business critical customer data, but don't do massive datamining projects on top of this. Then you end up with a data center that is 90% (business critical) prod, and triplicating that becomes much more relatively expensive than having a data center that is 20% prod.

Exactly, Although not always practical, if kept virus free (which of course is possible), offline back ups are the best solution because it's never broken into. ANYTHING online is risky, we all know this, so why do corporations still practically ignore the obvious?

Reply on news.ycombinator.com