2-3 year email retention on corp email.
Paper files for sensitive client info (or don't keep it).
We can reinstall office / windows / active director etc.
Mandatory 2FA on google suite?
Git codebases on github etc for LOB apps (we can rebuild and redeploy).
We use the lock features in S3 for copies of data that must be kept. Not sure I can even unlock to delete as account owner without waiting for timeouts.
I work at a big company that does this, but with 6 months. While I understand why they would do that, often some knowledge is lost with these emails. And usually I don't know what's knowledge and what's junk before I need it.
On the other hand, it's a good way to make sure that your processes are written somewhere and people don't rely too much on email archiving. Sadly, that's something I didn't realize until it was too late.
Most of the remaining suggestions aren't relevant to ransomware even if they're otherwise mostly fine recommendations. 2FA won't stop ransomware, or data destruction. Redeploying code and reinstalling active directory doesn't restore customer or user databases. Paper files are not accessible when they're needed, are easily damaged or misplaced, and cost a lot to store and index (if you're referring to keeping them as backups then yes you're making a form of the argument of the post just in a very expensive and inconvenient way). Read-only S3 copies are almost certainly falling in the realm of backups... but is also a relatively expensive way to do it for most organizations larger than a start-up.
Offline and offsite backups are the cheapest, most effective tool for keeping copies of your data in your companies possession due to unforeseen circumstances and they protect against a huge number of potential events beyond just ransomware. It's negligent IMO for executive officers of a company to not have invested in a solid, tested, and comprehensive backup solution.
Attacks involving credential stealing almost never involve malware.
Source: The 2020 Microsoft Digital Defense Report https://www.microsoft.com/en-us/security/business/security-i...
The S3 options around this work well with object lock or similar.
I remember the old school tape methods (we had a rotation of who took the tape home). This was truly offline
It won’t stop a root account compromise unless you’ve got a multi-account setup going (as they could edit the bucket policy).
But if you’ve not got any monitoring, they could also just remove the lock on the objects without you noticing and wait for the timeout themselves.