 |
 |
On Tue, Sep 1, 2009 at 4:47 PM, Houghton,Andrew<[log in to unmask]> wrote: ... > > 4) Server compromised. Worst case scenario. They need to preserve all > the drives so they can analyze them and turn over information to > police. They are not going to trust the backup/image since they don't > know how long the server was compromised. So they are most likely > going to rebuild the server from scratch and insure that it has *all* > the latest security and application patches, in addition to doing (1). > There was nothing in the message they sent that leads me to believe this was the case. I can only go on what they say, and what they said was: "Since last Monday (August 24th), when the PURL server suffered a significant hardware failure, GPO staff has been working at the highest level of priority to re-establish server access." Thus I have to believe them that they did not have a compromised server and instead they had a hardware failure. I have no idea why they couldn't just restore from backup which would at least gotten them back to where they were from the last backup (which presumably was at most a week ago, if not someone should have a lot of explaining to do to someone). Having to recreate a week of work wouldn't take that long and presumably the system could have been used while that happened. I hope the provide a post mortem because I like to learn fro these types of things so I can be better prepared if something like this happens to a system I'm responsible. > Nothing is as simple as it seems... Well, sometimes it is easier, but yes, I understand that sometimes these are harder than one would think. This is why you have to make sure, and test, that you have an adequate backup and recovery plan. This is basic systems administration. 8+ days to recover from a hardware issue a service that the GPO has been encouraging large numbers of people to use, seems more than excessive. For whatever reason they were not adequately prepared for "a significant hardware failure" on this service. Incidentally, this is one of the reasons I am very keen on virtualization. Moving a VMware image (or what ever competitor you prefer) to new hardware is a lot less complicated than moving physical machines. Edward