[mr_mitm]

The article does not say anything about Oakland negotiating. They may just be in the "it takes some time" phase at the moment. Tapes are not exactly the fastest medium.

Plus, you may want to determine the exact time at which you were compromised, or else you'll be restoring potentially tainted backups. Depending on how well you're organized that alone will take quite some time, especially considering that your logs may be encrypted as well. Sometimes you don't even know how to contact everyone, because your comms are down, too.

Sure, if you do everything right and adhere to all the best practices, it won't be that big of an issue. Just don't forget about the amount of legacy crap and budget constraints many orgs have to deal with. That comes with many pitfalls and a lot of opportunities to make a mistake.

[voidwtf]

This right here, the company I work for did some back of the napkin calculations for restoration times for archival storage (tape) and determined that it’d take us 2 days to restore minimum and up to 7 days to restore if the queues were full. This was with Azure and a relatively small amount of data (around 6TB).

We’re using their immutable storage option, with a 60 day window with multiple rotation intervals, and just biting the bullet on the cost of cold storage vs archival because of how slow tape is.

I could definitely see a larger entity having significantly more data and the restoration process can’t even start until they finish triage. No point in restoring until you know the source of the intrusion or at least have a plan to prevent it from recurring.

[ttt3ts]

For regular backups of 6TB why would you even consider tape? Seriously asking because I have priced tapes and the break even point vs hard drives is high.

[voidwtf]

Because we’re not paying for the tapes, Microsoft is.

Their archival storage tier is extremely cheap, but has a high retrieval cost and a very slow retrieval time. If you wanted to keep 1+ year full and incremental backups of a large amount of data it’d be a no brained. If you’re only keeping 60 day full and incremental than the retrieval cost and time doesn’t pan out cost wise IMO.