[magicalhippo]

> (i) an append-only database (no mutable data) to store everything business critical

How does that change anything? If your append-only database is encrypted by ransomware, you still have to recover from backups, no?

In which case you're in the same spot with regards to external services you integrate with. That is, out of sync.

[pengwing]

Not sure whether I understand your attack scenario: If the database itself has an exploit to bypass the append-only functionality: All is lost, agree. But if some of the hosts are compromised which push garbled/encrypted data to the database, you can recover from it by simply ignoring it as it does not overwrite any prior valid data.

[magicalhippo]

> you can recover from it by simply ignoring it as it does not overwrite any prior valid data

The point I'm trying to make is that a lot of systems interact with other systems.

For example, imagine my system generates an invoice, sends the invoice to a third-party for collection, the collection system replies with a token to track the invoice in their system. Finally the invoice is marked as paid once the third-party system returns an "invoice paid" message with that token.

Now imagine the system generated an invoice and sent it to collection, and is then hit by ransomware. I restore from backup or as you say ignore the data since the attack. Except now I don't have the token, so when I get an "invoice paid" message I don't know which invoice that was for.

We have several integrations which work not entirely unlike this, and disentangling the mess of these "desynchronization events" is what has taken the majority of our time when helping a customer after after a ransomware attack. Fortunately it's only been one or two a year.