Spring is well under way in Sweden. The birds are back, the evenings are getting longer and I see very little of it.<\/p>\n
Ransomware is everywhere right now. This month alone a major fuel pipeline in the US and the Irish health service have been hit, and those are only the ones that made the headlines. Most of the incidents never reach the news.<\/p>\n
My days at the moment start at six in the morning with a call to a customer in one time zone and end at nine in the evening with a call to another. In between there are investigations, bridge calls, coordination with the customer\u00b4s teams and a constant stream of new findings.<\/p>\n
What strikes me is how similar the incidents are. The attackers come in through a remote access service without a second factor, or a server that wasn\u00b4t patched. They get domain admin within days, sometimes hours, because admin credentials are lying around on servers and workstations. They find the backups and destroy them. Then they encrypt everything at once, usually on a Friday night.<\/p>\n
None of this is new to readers of this blog. Tier model, PAW, credential hygiene, immutable backups. It is the same list as always.<\/p>\n
If you have started on that list, keep going. If you haven\u00b4t, start this week. I\u00b4d rather meet you at a conference than on a bridge call at 21.00.<\/p>\n","protected":false},"excerpt":{"rendered":"
Spring is well under way in Sweden. The birds are back, the evenings are getting longer and I see very little of it. Ransomware is everywhere right now. This month alone a major fuel pipeline in the US and the Irish health service have been hit, and those are only the ones that made the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[83,33,42],"class_list":["post-1265","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-dart","tag-incident-response","tag-ransomware"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1265"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1265\/revisions"}],"predecessor-version":[{"id":1291,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1265\/revisions\/1291"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}