Pipelines, Ransomware, and The Solution

Surely a comprehensive backup strategy has to be the best line of defense against ransomware and any serious malware infections?

and for the follow-up, "Darkside" is now out of business.

It's an interesting story, apparently Darkside got way, way, more attention than they were expecting. They were even "attacked" by parties unknown that knocked them off the Internet. Steve Gibson's Security Now! podcast has the details: https://www.grc.com/sn/sn-819-notes.pdf

Did anybody just click on bb's link above? It's probably perfectly OK, but worth noting that pdf files are one of the commonest vectors of malware.

No offence intended to bb — just a thought...

@Stephe,
Well said. Anybody who was interested in the article would have gone to Steve's site direct, and searched for the referenced article. Alternatively, if SuperShield is installed and active, following the link direct would deny access if it was unsafe.

I am inclined to think that if Colonial Pipeline people only followed AskBob's advice/guidance on how to backup, they may have been $4.3Million ahead of their problems.

You object to the gummint regulating the private sector. Isn't that what happens when the private sector doesn't act responsibly? Critical infrastructure lacked adequate security and we all paid the price. Should we allow that to keep happening? If it happens again, won't you ask why nothing was done to prevent it?

Thanks again, Bob, for your wise words. The work that my wife and I do in our translation business contains sensitive, personal information. Finally I decided we should go the "extra mile" in protecting our clients information. I made the decision to go with Avast Ultimate plus VPN on all our devices. Also, all of our passwords have been in the protective custody of Last Pass for quite sometime. Yes, the cost may sound expensive but the peace of mind we now have is worth every cent. Our computers function smoothly, speedily and seem to pick up everything of a questionable nature. Following installation, the first time I went to our bank's website an notification window popped up, advising, "Three attempts to track your activity at this site prevented and removed."

“ New legislation has been proposed, which will undoubtedly have unintended consequences, because that’s what happens when government gets involved with the private sector.”
As opposed to the entirely predictable thefts, burglaries, and kidnapping that occur when the private sector is left to itself.

That was not the best lead in to describing the situation around the oil pipeline being shut down on account of a private sector firm’s error.

“ New legislation has been proposed, which will undoubtedly have unintended consequences, because that’s what happens when government gets involved with the private sector.”
As opposed to the entirely predictable thefts, burglaries, and kidnapping that occur when the private sector is left to itself.

That was not the best lead in to describing the situation around the oil pipeline being shut down on account of a private sector firm’s error.

Thanks Bob. Another great article that is spot on.

I started using PC-matic a few years ago and have been totally pleased. I love the way it blocks anything that isn't white listed.

Does PC Matic maintain a global whitelist as part of the decision-making it does for ALL its users? If so, an individual user (or even PC Matic's own screeners) may deem a program "OK" at some point but then a version that only SEEMS to be the same (and actually is corrupted) begins to circulate unimpeded.

Though Bob did not experience much of a burden in handling false positives, many of us won't be confident to dismiss warnings if we are not familiar with all the background processes launched in the normal course of using a computer. The more often you get asked to approve the launch of programs you don't know about, the more likely you are to bypass the interruptions and always say "Yes", which will eventually open the door to problems.

Most people will say OK to a request to run Java and Flash content even though those are now known to be bad risks. In fact, is it possible for even an historically "safe" program that everyone recognizes and which PC Matic allows to run, (such as MS Office or Acrobat Reader) to be launched by malicious script that uses that trusted program to execute its dirty work and remain undetected until it's too late? As an example, all recent Windows versions include an onboard encryption engine that will certainly be on the whitelist. What's to stop an attacker's script from invoking that existing "trusted" engine to encrypt your files and then hide the key from you until you pay up?

The fastest way to significantly reduce the number of ransomware attacks is for corporations to replace all Microsoft Windows operating systems with a more secure alternative. The inherent issues with Windows will continue to result in a whack-a-mole game until it is replaced with a modern operating system.

As a longtime reader dating back to the Tourbus days, I have found Bob's advice invaluable. When he recommended PCMatic, I changed and have not had a problem since.

I thought this was an excellent article on phishing email and how to spot malicious links. If you're looking for some material on phishing to share with family and friends this is a good one. It also includes a link to Google's Phishing Quiz.

The Most Common Way People Get Hacked & How to Avoid It
https://medium.com/geekculture/the-most-common-way-people-get-hacked-how-to-avoid-it-c62eeedf57d6

Thanks Brad, handy link. Ideal for a few vulnerable members of my family.

Interesting but quaint security ideas. The reality is that if you are connected to the internet and you are targeted (because you have deep pockets) then there is no defense.