The risk of a hacker attacking your business information systems has never been greater. In this post, we'll look at what you can do to keep Ransomware malware at bay, reducing the risk and impact of such an attack.
Huge changes in work practices over the past two years have changed the security goals of every organization. Staff are mostly working from home and employers have been forced to bring in new cloud-based productivity tools (automatically storing data and information online in a "cloud" of servers).
This change in technology use leaves little or no time to consider the full implications for cybersecurity. As a result, companies have become much more vulnerable to attack.
At the same time, the attack model has changed. Individual hackers, whose sole goal is to cause disruption, are no longer the biggest threat. They have been replaced by organized gangs of criminals out for financial gain. This has led to a huge wave of Ransomware attacks, which are both highly sophisticated and extremely destructive.
But what exactly is Ransomware and what can you do to keep it at bay?
We will show you how to reduce the risk of a Ransomware incident as well as minimize the impact of an attack should one occur.
What is Ransomware?
Ransomware is a specific type of malware that denies the victim access to their data and other IT resources until they pay the attacker a ransom. By far the most common type of attack works by encrypting data and holding the encryption key needed to decrypt it.
However, other methods include distributed denial of service (DDoS) attacks, where a hacker floods your servers with bogus requests to connect to your services, making it impossible for your systems to function normally. They will then send you a message asking for a ransom to end the attack.
Another form of Ransomware is doxware, where an attacker threatens to expose sensitive data that could seriously harm an organization or individual.
Phishing emails, which contain malicious hyperlinks or attachments, are the most widely used method of launching an attack. Employee negligence and poor user practices are also widely exploited by Ransomware attacks.
Do I have to pay the ransom?
The short answer is no. Ransomware payments are not the solution. It may seem like the only or even the most cost-effective option for companies that have been attacked.
You must remember that you are dealing with criminals and by paying, you are proving their business model and encouraging further attacks.
Even if you pay, there is no guarantee that you will get your data back. Criminals can easily demand more money for not releasing data that they know is sensitive or high-value.
Ransomware protection measures
The following are the most important first steps any company, regardless of size, should take to minimize the risk of a successful Ransomware attack.
1. Use Endpoint Detection and Response Software (EDR)
EDR ( Endpoint Detection and Response Software) is an advanced form of threat protection, often confused with antivirus software. However, antivirus products are generally only designed to protect against known threats, whereas EDR is able to detect and respond to many new forms of attack when they occur.
EDR works by collecting data from workstations and other endpoints and uses that information to detect signs of malicious behavior.
Since the sudden shift to remote working, EDR is becoming increasingly important as hackers find the opportunity to exploit weaknesses in a company's network.
2. Follow the Principle of Least Privilege (PoLP)
PoLP (Principle of Least Privilege) is an approach to IT security through which you provide each user with the minimum level of access to the data and resources they need to perform their role. For example, a member of staff may need to access personal data as part of their duties, but they don't need to change anyone's personal information. Therefore, you should grant them permission to read such data but not modify it.
PoLP can help reduce the risk of Ransomware attack through social engineering techniques such as phishing emails. Because, if a hacker manages to steal an employee's login credentials, it does not necessarily mean that they will have sufficient privileges to launch an attack.
3. Implement a strong password policy
Password files are favorite targets for hackers. Although the passwords contained in password files are hashed, making them unintelligible, attackers have a number of tricks up their sleeve to crack them. However, the longer and more complex the passwords are, the harder they are to crack.
Therefore, it is important to enforce strong passwords by imposing a minimum length and requiring at least one number, uppercase, lowercase, and non-alphanumeric characters. That way, in the event someone stole your passwords, it would be very difficult for the perpetrator to crack them.
You should also rotate passwords as part of a strong password policy. In other words, you should require users to change their passwords periodically. This effectively limits the time attackers have to crack your passwords and use them
4. Enable Multifactor Authentication (MFA)
If your systems support MFA (Multifactor Authentication), where users have to go through an additional verification step, such as entering a one-time password sent to their phone, you should enable it as soon as possible.
MFA acts as a layer of defense by putting another barrier that an attacker must overcome to get into your systems.
In addition to one-time passwords via SMS, other forms of MFA include:
- Authentication apps for desktops and mobile phones
- U2F physical security keys that connect via Bluetooth or plug into your USB port
- Delivery of login confirmation codes to your email address
- Biometric authentication, such as fingerprint, facial and voice recognition
5. Keep software up to date
Software updates and code updates contain fixes to vulnerabilities that can be exploited by attackers at any time. Therefore, you should apply them to your software and operating systems as soon as they become available.
But always remember to take backups before installing updates so that you can recover quickly if you experience issues such as a system error or loss of critical functionality.
In cases where you cannot tolerate any downtime, you may need to administer updates in a test environment first in order to check for any potential problems before installing updates. Increase employee cybersecurity awareness[/B]
According to a Stanford University study, human error was the root cause of nearly 90% of all security incidents. The study also revealed that the younger generation was more vulnerable to phishing attacks - with 25% saying they had clicked on a phishing link compared to just 8% of workers over the age of 51.
Your users are the weakest link in the security of your systems. So it's worth cultivating a culture of security in your business.
Enroll employees in a security awareness course and back them up with your own tips on security best practices. If you periodically remind them of daily risks, such as sharing anonymous media, clicking on malicious links and using public Wi-Fi services, you'll be much less vulnerable to a Ransomware attack.
Business Continuity and Disaster Recovery (BCDR) measures.
In addition to strong security procedures and processes, you should also have measures in place to get your business back on its feet as soon as possible in the event of an attack or unavailability of its services.
This is what Business Continuity and Disaster Recovery (BCDR) intends to achieve.
Whatever the nature of the outage, whether through a Ransomware attack, power outage, hardware failure, human error or unforeseen adverse events, BCDR will help ensure the rapid recovery of IT systems and mission critical data with minimal disruption and cost to your business.
The following steps are an integral part of a well-designed BCDR plan.
7. Follow the 3-2-1 Backup Rule
You should never rely on a single backup of your data. Restores may fail.
Also, the most advanced Ransomware attacks also target your backups.
To ensure adequate protection, you should follow the 3-2-1 backup rule, whereby you keep two local copies, your production data and one backup on a different medium, and another copy stored on an off-site service.
The local backup will be immediately available for simple and quick recovery. However, it will also be more vulnerable to attack.
The off-site backup, on the other hand, will be removed from your on-site systems. Therefore, hackers will have a harder time attacking it, as they will likely need additional access credentials and also additional network information to locate it. This will be especially true if you use a cloud backup service.
8. Take immutable backups
An immutable backup is a copy of your data that cannot be modified, encrypted or deleted. It uses locking technology that prevents anyone, including users with administrator privileges, from making such changes until the end of a specified retention period.
Therefore, you can be confident that you can recover your services after a Ransomware attack or any other type of data protection incident.
9. Checking your backups
It could be some time since an attacker first breached your system.
During this time your backups will also have been infected. Therefore, make sure that your backup system not only takes copies of your data, but also scans it for malware. That way, you can be sure they're clean and safe for use whenever you need them.
And don't forget to test your restore system on a regular basis, as you want to make sure it's working properly when you need it and that your backups are free from corruption or other problems that could prevent recovery.
10. Establish an incident response plan
Recovering from a Ransomware attack can be a huge undertaking as your services operate securely. You may need to do a detailed analysis to establish the full facts of the incident
If the attack involves a threat of a data breach, you will most likely need to report it to both the National Cyber Attack Response Team (CSIRT-CY), the Digital Security Authority (DSA), the Office of the Communications Commissioner, and the Police.
Therefore, it is important to develop an incident response plan so that you are properly equipped to deal with an incident. This should prioritize the recovery process.
Prepare
The best defense for any organization is to be prepared for any type of Ransomware attack.
- Check your security.
- Increase your security.
- Implement backup and recovery procedures.
- Train your human resources.
If you think you are at risk, take action!
(NΓ/SX)
Contents of this article including associated images are owned by PIO
Views & opinions expressed are those of the author and/or PIO
Source
