Suncor Energy Major Cybersecurity Incident/Outage

[DoubleF]

Originally Posted by Fuzz

How do they not have a disaster recovery plan? Rebuild from scratch? That's the plan?

It's possible the disaster recovery plan was compromised too.

I heard of an IT company like this before. I heard the clients servers, their servers and the server with the backups were all ransomwared. Some of the clients had no choice but to pay the ransom or they'd be out of business. Some clients took it as fate and closed down their businesses and retired.

It was so ####ing jaw dropping moronic.

[Flacker]

Originally Posted by DoubleF

It's possible the disaster recovery plan was compromised too.

I heard of an IT company like this before. I heard the clients servers, their servers and the server with the backups were all ransomwared. Some of the clients had no choice but to pay the ransom or they'd be out of business. Some clients took it as fate and closed down their businesses and retired.

It was so ####ing jaw dropping moronic.

A company the size of Suncor has to have immutable offsite backups of critical systems, or there has been complacency and neglect for a long, long time. Ransomware is not a new concept.

Or there was complacency and neglect in the time to detect the compromise, and the immutable backups got impacted.

[DoubleF]

Originally Posted by Flacker

A company the size of Suncor has to have immutable offsite backups of critical systems, or there has been complacency and neglect for a long, long time. Ransomware is not a new concept.

Or there was complacency and neglect in the time to detect the compromise, and the immutable backups got impacted.

Oh, I was just talking about some IT people being morons. I've heard of companies where the off site systems were removed for "cost cutting measures" even though the IT department was protesting.

I'm also just saying that moronic things happening to key systems is nothing new.

[Bill Bumface]

Originally Posted by Flacker

A company the size of Suncor has to have immutable offsite backups of critical systems

Just because you have them, doesn't mean someone can't reach them if they get in the gates.

As someone wise told me "As a head of infosec, you only have to be wrong once to be screwed. As an attacker, you can try thousands of times and only have to be right once".

[Hack&Lube]

https://www.cbc.ca/news/canada/calga...ctor-1.6898118

To me, all signs point to an intruder or malware was successful in penetrating their environment and lurking/staying dormant for long enough that they don't know what devices and accounts and systems are compromised because of the spread of the malware or by potential lateral movement.

That explains why they might be wiping all accounts and rebuilding from scratch as well as replacing all endpoints in phases because they have no way of knowing that even if they restore all systems that attacker hasn't hidden backdoors, worms, etc. that could be reactivated after the all-clear.

So in this case, it's not so much about time for restoring backups, but a complete decontamination and clean sweep of all systems. That also indicates to me that given the timeframe, that the backups might have also contain those same backdoors and malware so they would need to be very careful about what to restore. If they surmise from the SIEM and forensics that someone has been poking around their network for the past 6 months undetected for example - how can you safety restore from backup without losing 6 months of business changes?

[Azure]

I work with a few companies that got hit worldwide and they chose to have a month of downtime and rebuild from scratch. Cost them millions to do so.

Not sure to avoid getting hit if the infection lurks in your system that long.

At that point it isn't as much about backups as it is perhaps detection. Gotta invest in something (Huntress, etc) that has the capability of letting you know 'hey, even though its not locking you down, you got hit and you need to deal with it.'

Otherwise it'll sit there and try to gain access to everything possible before they execution the encryption.

[Hack&Lube]

Originally Posted by Flacker

A company the size of Suncor has to have immutable offsite backups of critical systems, or there has been complacency and neglect for a long, long time. Ransomware is not a new concept.

Or there was complacency and neglect in the time to detect the compromise, and the immutable backups got impacted.

People talk during Stampede week. May have just been a drunken game of telephone, but I heard they have no recoverable backups

[chemgear]

Originally Posted by Hack&Lube

People talk during Stampede week. I heard they have no recoverable backups

[Whynotnow]

Originally Posted by Hack&Lube

People talk during Stampede week. May have just been a drunken game of telephone, but I heard they have no recoverable backups

It may be that they didn’t trust anything at all, so they may have backups but don’t even know if they are safe.

[CaptainReboot]

Some of their systems are back up and they do have some clean environments now. Their environments basically had to be rebuilt. All employees are getting new laptops. Talking to friends that work there, it’s a mess but expected since they had very little controls apparently.