Page 58 - Cyber Warnings

This was clearly an accident and not a case of malicious insider misfeasance. The SysAdmin
was at work later in the evening, and in the fatigued state inadvertently deleted a director on the
wrong server. Within this directory was a folder holding 300GB of live production data, which
was supposed to be backed-up.

The SysAdmin realized the oversight when there was only 4.5 GB of data remaining. At this
point the SysAdmin was thinking of the back-ups and hopping these were still working and in
viable.

Although this would have been a great use of the back-ups and a victory, there unfortunately
were issues. This use case involved live data. The prior viable back-up was completed six hours
previously, so there was a gap. To add an issue to this, GitLab utilized five back-up formats.
None of these continued data or was set-up initially.

Oops.

Lessons Learned

The application of insurance is to protect against an event with a low chance of occurring that
would have a large impact if realized. This was one of those cases. The back-ups are a form of
insurance. With a catastrophic, epic failure, the business operations would simply cease or
nearly so. The business would need to use paper again to do much of anything.

The users and Admins may not put a mass amount of thought into this, until the back-ups are
needed. At this point, it may be an emergency to get these in place and working.

The business needs to have regular back-ups scheduled and tested regularly. Without these,
the Admin is merely hoping and placing their reputation on a report.

About The Author

Charles Parker, II began coding in the 1980’s. Presently CP is an Information Security Architect
at a Tier One supplier to the automobile industry. CP is presently completing the PhD
(Information Assurance and Security) in the dissertation stage at Capella University. CP also is
an adjunct faculty at Thomas Edison State University. CP’s interests include cryptography,
SCADA, and NFC.

He has presented at regional InfoSec conferences. Charles Parker, II may be reached at
[email protected] and InfoSecPirate (Twitter).

58 Cyber Warnings E-Magazine – June 2017 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide