Criminals have always targeted financial chokepoints. In the past, this was in the form of storage facilities and transports of valuable items. Nowadays, reliance on technology and data for business operations has created a “single point of failure” for most organizations. Information System outages can completely inhibit even the most basic operations.
Ransomware is a targeted form of malware that aims to “lock” data and systems within an environment in order to extort a payment. This attack method has grown into a criminal industry of its own, complete with support staff, payment portals, and malware engineers. By targeting organizations of all sizes and industries, ransomware has become a persistent and existential operational threat. Unfortunately, there is no known method to 100% prevent ransomware from affecting an organization. The best thing an organization can do to reduce the impact of ransomware is the implementation of a comprehensive cybersecurity plan, ranging from prevention to response.
1. Preventative Cybersecurity Controls
Perhaps the most well-known cybersecurity practice on this list is also one of the most important. By preventing ransomware from running on systems, there is very little need for recovery. No single control will be completely effective against all strains of ransomware, and standard Anti-Virus is fighting an uphill battle to remain relevant as cybercriminal tactics expand.
Example Tools and Services:
- Anti-Virus Software
- Endpoint Detection and Response Solutions
- Application Whitelisting Solutions
2. Detecting Ransomware
Detection of ransomware can be critical in the early stages of spreading. Often, ransomware is delivered via phishing emails or other malicious files that contain “first level” drops which callout to a home-server for the final malware package. Detection during these early phases can prevent a complete network encryption. Solutions that rely on detecting ransomware early usually require urgent manual remediation before the threat actors expand their hold.
Example Tools and Services:
- Security information and event management (SIEM)
- Security Operations Center (SOC)
- Endpoint Detection and Response Solutions
- Dark Web Scanning and Assessments (Detect Leaked Data and Passwords)
3. Incident Response Planning
Incident response planning is usually underemphasized in a system security plan. Protecting the network can only get an organization so far. An attacker only has to get lucky once. Whenever the worst does occur, best practice dictates that a plan should be in place. Every organization is not expected to have the skills, team, and resources to deal with a cybersecurity incident. However, having a pre-defined contact (outsourced) and budget to deal with these events should be at the top of any disaster planning agenda.
Example Tools and Services:
- Internal Incident Response Team
- Outsourced Incident Response “on retainer”
- Established Incident Response Guidance
4. Disaster Recovery and Disaster Recovery Services
Disaster recovery services are different than simple backups. Disaster recovery planning and services are the “next level” of backup, emphasizing rapid business operation recovery in the event of a disaster such as ransomware. These services often utilize specialized tools that enable remote hosting and rapid temporary infrastructure deployment in order to immediately resume business operations while the incident response takes place.
Example Tools and Services:
- Internal Disaster Recovery Planning with backup infrastructure
- Disaster Recovery as a Service (Outsourced)
5. Centralized Management of Assets
Centrally managing assets is a key aspect to complete cybersecurity and IT posture. By monitoring asset health (drive status, CPU usage, account activity, etc.), IT staff can detect anomalies indicative of a threat. Remote management capabilities enable incident responders to rapidly audit devices and control endpoints where needed. Without central management of devices, ransomware is much more difficult to deal with on an emergency timeline.
Example Tools and Services:
- Remote Monitoring and Management Tool
- Outsourced IT and Cybersecurity Management
- Specialized Endpoint Security Solutions with Central Management
6. Defense-in-Depth Security Planning
Comprehensive security planning relies on a principle known as Defense-in-depth. By segmenting networks and implementing robust and redundant controls around each sensitive asset in a variety of categories, organizations can ensure that systems are protected by a diverse suite of controls. Ransomware would then need to breach several layers of defenses in order to successfully propagate.
Example Tools and Services:
- Internal Risk Map and System Security Plan
- Outsourced Cybersecurity Services
- Detailed Network Map with Projected Threat Vectors
7. Threat Intelligence Feeds
Knowing the current threats facing an industry can be a significant advantage when evaluating risk. Certain ransomware groups target specific industries such as finance, construction, government, education, healthcare, etc. By staying informed on the tactics, techniques, and procedures (TTP) utilized within groups targeting an industry, relevant controls can be utilized and configured to prevent these attacks.
Example Tools and Services:
- Custom Threat Intelligence Feed
- Outsourced Threat Intelligence
- Internal or Outsourced Managed Cybersecurity
8. Cybersecurity and IT Audits
Audits are key to detecting gaps within a cybersecurity posture. Whether these audits are performed by an external or internal party, their importance cannot be overemphasized. A comprehensive picture of an organization’s network can reveal glaring holes in policy or controls, enabling an effective plan of action to be created.
Example Tools and Services:
- Annual Third-Party Cybersecurity Audit
- Vulnerability Scans and Penetration Tests
9. Monitored and Aggressive Patching
Aggressive patching of critical security flaws in applications and operating systems is one of the most effective steps that can be taken to reduce the risk of a ransomware attack. Very often, ransomware exploits a recently discovered vulnerability in a system to spread rapidly within a network. By monitoring the patch status of devices and pushing patches on an aggressive timeline, the worming behavior of ransomware can be stopped cold.
Example Tools and Services:
- Remote Monitoring and Management Solutions
- Managed Cybersecurity and Patching Services
- Automated Windows Patching and Compliance
10. Cyber Insurance
If an organization were to follow all of the recommendations above and still get affected by an irreversible ransomware attack, cyber insurance would be they key to avoiding financial ruin. These insurance agencies provide coverage based on assessed risk and will help recover from the financial effects of a successful attack.
Due Diligence
Through all these recommendations, one overall question should rise to the front of any organization’s leadership: Are we doing everything we can to prepare for ransomware? Attacks are happening on an unprecedented scale, specifically affecting critical government infrastructure and small businesses. It is no longer optional – take the necessary steps now to prepare for a ransomware attack before it is too late.
