Don’t Wanna Pay Ransom Gangs? Test Your Backups
There&#x27;s been a lot of good advice here about backups and disaster recovery.<p>But there&#x27;s also a lot of other stuff to consider:<p>Compartmentalization. Finance and Engineering and Sales only need to interact in limited ways. How about some firewalls  between them, limiting types of access?<p>Location isolation. Why does something that happens in Peoria affect Tuscaloosa? Once a ransomware gang breaches a perimeter, why is it allowed countrywide (or worldwide) access to a company?<p>Monitoring. Aren&#x27;t there tools that can alert on various anomalous patterns? All of a sudden, gigabytes of data start being exfiltrated? All of a sudden, processes fire up on a multitude of servers? Monitoring these things is hard to do at scale, but surely possible?<p>Microsoft. In 2002, Bill Gates &quot;Finally Discovers Security&quot;. How much longer will Microsoft be given a free pass? How many more &quot;critical&quot; vulnerabilities will their software have? <a href="https:&#x2F;&#x2F;www.wired.com&#x2F;2002&#x2F;01&#x2F;gates-finally-discovers-security&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.wired.com&#x2F;2002&#x2F;01&#x2F;gates-finally-discovers-securi...</a><p>I could go on and on. But why should I? Why can&#x27;t MBA-type CEOs take IT seriously? Why can&#x27;t they hire competent people and fund them and listen to them?