Ransomware

Typically the cybercriminal also takes steps to evade logging, detection, and response.

WHAT THE CRIMINALS DO

Cybercriminals employ several tactics to maximise the damage they cause.

TARGET BACKUPS

Organisations with backups that are difficult for the cybercriminals to reach are much less likely to have to pay a ransom. Cybercriminals often target backups to limit your options in critical situations. They may delete entire virtual machines that host backups or modify business-critical files and wait to launch their full attack once the desired recovery point is no longer available. 

EXFILTRATE DATA

In most ransomware incidents, cybercriminals are now also stealing data. 

LAUNCH RANSOMWARE

Newer ransomware variants can encrypt faster and employ better encryption techniques to make recovery harder. 

RANSOM DEMANDS

The cybercriminal demands a ransom payment in cryptocurrency to provide one or more decryption keys for your data. In some cases, they might also promise to delete stolen data.

Cybercriminals recently have used new techniques to increase the pressure on an organisation to pay. One technique is to contact employees directly with their personal information attached. They will try to undermine an organisation to control the narrative about the incident response and portray the response as ineffectual to  add pressure to their ransom demand.

Phishing is one of the main ways that cybercriminals steal credentials or get employees to download malicious software.

REDUCE EXPOSURE TO PHISHING EMAILS

Implement measures that could change the way suspicious emails are handled (SPF, DKIM, DMARC are email security standards that can help to mitigate spam and phishing attacks). Consider blocking emails from new domains, which may have been set up by cybercriminals for phishing.  

Patch on-premise email servers to deprive cybercriminals of any low-hanging fruit. 

INTELLIGENT EMAIL EVALUATION

Automatically detonate and evaluate inbound attachments and links in a sandbox environment to determine if malicious prior to user delivery.

Train employees to recognise phishing emails and resist attempts to steal credentials or click on attachments or links.

Keeping systems and applications up-to-date is critical in preventing unauthorised access and malware infections.

MANAGE ACCESS

Put in place appropriate measures for general user and system access across the organisation: privileged access for critical assets (servers, end-points, applications, databases, etc.) and enforce multi-factor authentication (MFA). 

MANAGE YOUR ASSETS

Your asset management inventory system should include an asset discovery tool that continuously maps devices on your internal network, an up-to-date asset database, and an up-to-date configuration management database.

IMPLEMENT EDR

When effectively deployed and monitored, end-point detection and response (EDR) tools are one of the best defences against ransomware and other malware attacks.

EDR solutions monitor servers, laptops, desktops and managed mobile devices for signs of malicious or unusual user behavior/activity. These tools also enable quick response by trained security experts. EDR needs to be in enforcement mode rather than audit mode.  

GET A CONFIGURATION ASSESSMENT OR PENETRATION TESTING

Many organisations benefit from external help to identify weaknesses in firewalls or switches leading to lateral movement in their system, and to understand how a cybercriminal might be able to move around their system.

SECURE YOUR BACKUPS

Backups should be on a non-virtual device, and immutable if possible. If backups are actively replicated to an off-site facility, the compromise of one copy could render the other useless.

Keep firewall logs, which roll over quickly. If you have centralised logs, protect them and keep a copy. If possible, disconnect suspected compromised devices from the network. Try to avoid turning them off if possible.