دانلود کتاب آموزش واکنش و بازیابی باج‌افزار -متوقف کردن باج‌افزار، بازیابی یک به یک

On the very day I (Curtis) finished my final edit of this book to hand over to my amazing editor, Sara, the tech world fell apart, and I thought it would make a great story to open this book. While it doesn’t appear to be ransomware related, it does show just how much we have all come to count on technology and how businesses don’t know what to do when the tech they count on simply doesn’t work. The first thing my daughter, Marissa, noticed on October 20, 2025, was that Netflix wasn’t working. Marissa, her husband Hunter, and my granddaughter Lily sat down to watch something together, and it just wouldn’t play. “That’s odd,” they thought. She went to work at a clinic, and some of her patients that she tells me are “tech people” told her there was a big outage. She thought, “Well, that has nothing to do with me.” But later she noticed that she couldn’t access some of her patient records. She had to resort to paper and pen for records. “That’s super annoying,” she thought. Then she noticed that her patients couldn’t use some of their streaming services. Weird. When she got home, she found out that Lily couldn’t do her online classwork. What is happening? The final straw, she told me, was when she couldn’t turn on her bedroom lights. Apparently, she solved a problem by hooking them up to—you guessed it—Alexa. And Alexa was down. On the same day, a friend of mine was in a hospital that was completely offline, and a restaurant that I’m a regular at (Hello, Beach Break Cafe in Oceanside!) had issues as well. Their POS system worked, but they couldn’t enter tips. All of this because DNS wasn’t working on DynamoDB in the US-East-1 region of AWS. Imagine the pressure those folks were under that day and resolve to at least have a plan for when this happens to you because of ransomware. I sent the initial idea for this book to O’Reilly almost three years ago, when I saw what was happening where I worked at the time. I was working for Druva, a SaaS-based backup and disaster recovery provider, and every Monday morning, we’d review the previous week’s restore activity. It’s the kind of meeting that should be routine and boring. Except it wasn’t. Week after week, I watched the ransomware restore numbers climb. Not the normal “Oops, I deleted a file” restores. These customers had been fully encrypted by ransomware and had to restore everything. Thankfully, they were always able to recover their data, but the numbers went from one or two a month to two or three ransomware restores a week! These were our customers. They were the lucky ones because Druva by default secures your backups the way I recommend in Chapter 6 (e.g., separate credentials, air-gapped copy, immutable storage). But even then, we started seeing something that made my blood run cold: threat actors were getting smarter. They were clearly targeting the backup data. What used to be an afterthought for attackers had become target number one. I’ll never forget one customer whose attackers attempted to delete their backups. There was plenty of evidence of the attempts, and thankfully they had all been stopped. But I just couldn’t help wondering, what if they had succeeded? That’s when I started making protecting our customers’ backups against ransomware my number one priority. I didn’t care about new platforms or additional features. I just wanted to make our customers’ backups as secure as possible. (The good news is I wasn’t alone; it’s just that I had the luxury of being singularly focused on this.) And the stories outside Druva kept coming as well. I’d read about attack after attack where the common thread was always the same: “Backups were encrypted or deleted prior to the attack.” I can’t tell you how much it hurts my heart to read that. But here’s what really got me: about 90% of these attacks could have been stopped at the very beginning. Not with some million-dollar security platform. Not with an army of SOC analysts. Just by following basic cyber hygiene practices that every IT person already knows they should be doing.