While there is no magic bullet to 100% protect against a ransomware attack, these five strategies can help you measurably lower the cybersecurity risks associated with ransomware attacks.
When it comes to ransomware, everyone is looking for a magic bullet – but buyer beware. There is no technology on the market today that can provide a 100% guarantee to protect against a ransomware attack.
The good news is that you can manage the cybersecurity risks that lead to ransomware attacks to reduce the chances of criminals taking over your network. Using these strategies, you can also prepare to respond quickly and lower the financial impacts should the unfortunate event occur.
For the “TL;DR” readers, let’s talk about how to protect and defend against ransomware first. Here are five things that every organization should be doing today.
Ransomware attacks have become part of the daily cybersecurity news cycle, as threat actors continue to find soft targets across the United States. From 2015 to 2016, attackers have increased their extortion demands because they discovered their victims will pay higher prices to get back their data and systems. In the past year alone, after targeted ransomware attacks, numerous state and local governments have gone offline, schools have been interrupted, and healthcare organizations have had to shut their doors.
The financial impacts of these interruptions have been significant. Recent estimates stemming from the ransomware attack on the City of Baltimore in the spring of 2019 put the cost of the attack at $18.2 million dollars. The City of Atlanta estimates their 2018 ransomware attack costs have surpassed $17 million dollars, or 2.6% of the city’s annual budget.
The word “ransomware” conjures up images of hackers in hoodies running nmap scans on a laptop covered in anarchy stickers. But that pop culture image is actually part of the problem – the myths about ransomware mean many folks don’t really know what it is, who is spreading it, and how to protect against it.
Historically, ransomware has been largely opportunistic in nature; the threat actors behind these attacks send out a phishing email campaign and see who bites on the bait and detonates the malware. However, this has recently shifted to more deliberate targeting of organizations that have a defined set of attributes:
This trend has put local government (cities, counties, school districts) and the health sector (notably mid-market and rural hospitals and clinics) in the crosshairs. And in a disturbing twist, the recent ransomware attacks are increasingly coming from state-sponsored actors running money-making operations that simulate organized crime.
To defend yourself against malware, you have to understand what it is and how it works. Ransomware is an attack on the availability (and sometimes also the confidentiality & integrity) of information systems. It attempts to extort the victim by encrypting their data, essentially rendering it and the system it’s on useless without the decryption key. The attacker holds the data ransom pending a transfer of cryptocurrency, and often (but not always) provides a decryption key once the ransom payment is received.
When considering a highly targeted ransomware attack, for the ransomware to encrypt data that the victim will actually pay a large sum of money to retrieve, the attacker needs context. Simply locking up a random laptop is unlikely to result in any significant amount of money to extort; what they are after is critical data – PII/PHI, trade secrets, financial data, information or applications that are crucial to operations.
Identifying this information can take time, meaning that the damage isn’t necessarily done instantaneously when an employee clicks on a malicious link or attachment. We’ve seen various types of ransomware, and some encrypt faster than others. Looking at it from a criminal’s point of view, ransomware can encrypt immediately, but might not get the most valuable files. It can ping a command and control (C&C ) server, find something a little more valuable (like “recent documents”) and then encrypt – which might take as little as three seconds. Or, it can ping a C&C server, spend a more significant amount of time looking for valuable files to encrypt, and then hold hostage the most valuable files.
The attackers are also smart enough to know that you make backups of this sensitive information, and if you are not protecting those backups from unauthorized access, the attacker will make sure they encrypt the backup copies as well.
If all of the protective measures fail, and you are faced with losing a lot of encrypted data… you’ll be faced with the question: Do you pay the ransom?
If the protective and defensive tactics failed, you’ll have to figure out whether to pay off those demanding the ransom. Often, for those with coverage for ransomware events, that decision is made by cyber-insurers, and you should notify your insurer as soon as an event occurs.
While on a panel at the Maureen Data Systems Cybersecurity Conference, we asked panelists Eric Humbert of the US Secret Service and Dr. Eric Cole of Secure Anchor to give their opinions on whether to pay ransomware demands. There was consensus among the three of us that while this is a business decision, it is one that should be informed by the reality that payment does not guarantee decryption of the data, and it may place organizations at higher risk for future attacks. Prevention and rapid detection are key.
If you haven’t conducted an investigation and determined how the event was initiated or have not determined whether additional malware and/or backdoors have been installed, do it immediately after recovery or the bad guys will use the same vulnerabilities they used before, or the backdoors they just installed, to ransom your data a second time. If you haven't plugged the holes they found on the first attack — which they’re counting on — you are going to get hit again. In the case of Baltimore, the city’s emergency services were hit by a ransomware attack in March of 2018, a little over a year before the larger, more impactful, attack occurred in May 2019. The city clearly missed their opportunity to manage the risks.
Since the scourge of ransomware isn’t going away, hopefully this article gives you what you need to prevent, stop, and defend against an attack.