See the original publication found in On Balance Magazine.
At some point in 2015, cybercriminals had an aha moment. Instead of going through all of the trouble of breaking into a network, stealing data and then executing a complicated scheme to monetize that data, they found a shortcut – and it was already paved.
Data encryption was touted as a defense against attempts to steal data, and companies implemented encryption to keep their data safe. It did not take long for the bad guys to figure out a way to turn those defenses around: Encrypt the data and hold the key for ransom. Already armed with methods to trick users into running things they should not, attack methods were created that locked companies out of their own computers, data stores and applications.
Faced with the prospect of being without key systems and data for long periods of time, criminals offered a quick fix: Pay us to fix it. Insurance companies often encouraged payments, calculating that it was more economical to pay upfront than to pay for rebuilding systems, covering lost revenue and buying new equipment.
The result was predictable. Criminals saw big pockets behind the companies they were attacking. They widened their attacks and increased the ransom demands. More criminals got into the game, realizing how profitable this venture was becoming.
How to measure your readiness
The biggest question that companies are asking today is this: “Can we survive a ransomware attack?” To answer that, it is best to break the threat down to four questions:
- Can we protect against the attack?
- Can we detect the attack?
- How do we respond to the attack?
- If the attack is successful, how will we recover?
Protect
The components of protection should be familiar, as they are the basic hygiene items needed to stop any cybersecurity threat:
Rights management
- Privileged access or admin access to devices throughout the network should be limited, with specialized accounts set up for local administrator tasks. When many users have admin access to many machines, ransomware spreads like wildfire.
- Access to file shares across the network should be only as-needed. Ransomware will look to encrypt whatever files the user who launched it can see and change. If the infected user has limited rights on file shares, the damage that can be caused will be limited.
Patch management
Malware normally finds its way onto computers that are missing patches. Ransomware is no different; yet patching continues to be a shortcoming in many organizations’ defenses. The keys to having an effective patch management program are to:
- Ensure ALL operating systems and platforms are covered by an automated patching system.
- Ensure ALL applications are covered by an automated patching system.
- Perform scans routinely on all systems in the environment to confirm the automated patching systems are functioning as intended.
Endpoint protection
Organizations need to have current and up-to-date technology defending endpoints. Anti-virus applications installed and forgotten five years ago do not meet this requirement. Make sure the endpoint protection system is actively monitored to ensure components are current and protections are not disabled.
Network segmentation
When commercial buildings, hotels and homes are built, codes have to be followed for a number of reasons, one of which is to ensure that fires have difficulty spreading from room to room and floor to floor. A computer network should be no different. Networked devices in one department should be able to see networked devices in another department only if there is a justified business requirement.
Detect
One of the most important aspects of limiting the damage of a ransomware attack is to know when it is happening. Following are the key steps to sharpening any company’s detection capabilities:
UNDER IMAGE: “How an organization responds to a ransomware attack directly affects the amount of system damage caused by the attack.”
- Have a correctly configured Security Information and Event Management (SIEM) tool. SIEM tools collect logs from a variety of sources. But a SIEM is like a musical instrument. It will be a dust collector unless someone knows how to play it. SIEMs prove their worth when they are configured to analyze the logs and produce alerts directed to the right people. Instead of having people who pore through logs looking for problems, a finely tuned SIEM is a force multiplier, sending the right information to the right people to allow them to troubleshoot and prevent problems before they escalate.
- Conduct realistic tabletop exercises. Many organizations go through the exercise of bringing people into a room to talk about a possible scenario and find out what will be done. Very few organizations integrate actual actions, such as retrieving log information or confirming SIEM notices as part of the exercise. Put realism into these exercises by having simulated attacks during the tabletops to prove your detective measures are working.
Respond
How an organization responds to a ransomware attack directly affects the amount of system damage caused by the attack. That response also affects the damage to its reputation with customers and the morale of its employees. This is where a formal incident response plan (IRP) is essential. The basic components of the IRP should include:
- Defined members of an incident response team (IRT).
- Contact information for external resources (such as the media, law enforcement and third-party consultants).
- Templates for communicating with employees, customers and vendors.
Specific to ransomware, the IRP should have a playbook for procedures related to a ransomware attack. Such a playbook can be designed through a tabletop ransomware exercise. This playbook will be unique to the organization with steps specific to the IRT members. Steps should include:
- User actions when ransomware is suspected.
- Specific steps for isolating network segments or systems.
- Communication steps with members of the IRT.
Recover
Recovering from a ransomware attack normally involves one of three options.
- Recover via backups.
To be viable, backup systems and images cannot be compromised by the ransomware. Attackers will often look to encrypt backup systems first so that a system restore is not possible. To protect the ability to recover systems and data, organizations should:
- Maintain protected gold images of systems to ensure restoration to a known trusted state.
- Keep copies of data backups that cannot be overwritten and are disconnected from the production network.
- Pay the ransom.
Some companies are forced into this solution. Some look to it as the path of least resistance. There are risks that come with this choice: Will the decryption key be effective? Criminals realized early on that it is more profitable in the long run to provide the key. That does not mean it will be useful. In the case of the recent Colonial Pipeline attack, a large payment was made only to find the decryption tool was too slow to be of use (Morse, 2021). Unfortunately, if you’re attacked once, you may be attacked again. A recent report indicated that 80% of businesses that paid to recover from an attack experienced a subsequent ransomware attack (Yu, 2021).
- Rebuild from scratch.
This is the most painful scenario, normally chosen when backups cannot be restored and/or the purchased decryption key is not working.
What next?
Hopefully, this guide helps you to understand and prepare for these attacks. The tactics of the criminals continue to escalate with the release of captured data and the use of personal attacks on corporate executives to compel payment. Our efforts to resist need to meet these threats.
Reach out to SynerComm to protect yourself before an attack
The website “No More Ransom!” contains resources to help victims retrieve their data without paying the criminals. Tools include working decryption keys for known ransomware variants
In June 2021, the National Institute of Standards and Technology (NIST) released a draft of a framework to use in managing risks associated with ransomware
