Upload File

making recovery part of your ransomware preparedness strategy a execuve brief · 2020-05-18 ·...

  • Home
  • Documents
  • Making Recovery Part of your Ransomware Preparedness Strategy A Execuve Brief · 2020-05-18 · Execuve Brief ® Making Recovery Part of your Ransomware Preparedness Strategy The
3
A Execu(ve Brief ® Making Recovery Part of your Ransomware Preparedness Strategy The Cost Poten+al in Ransomware Today, ransomware is a business – yes, business. Driven mostly through ransomware-as-a- service pla<orms run by organized crime gangs, ransomware is the fastest growing threat today. And it’s no surprise, given a single ransomware aAack campaign can net the criminals millions of dollars, in return for very liAle risk, expenditure or chances of being caught. The following stats will give you some idea of the cost of ransomware: Revenue (annually): $1 Billion+ InfecIons: 4000+ daily Avg. Ransom: 3-5 Bitcoins (in USD): $3500-6000 Avg. Impact: 6 worksta+ons 2 servers Avg. DownIme: 12 hours Avg. RemediaIon: 12 hours Sources: FBI, KnowBe4 Survey Ransomware: Today’s Threat Reality Ransomware has become the threat-du-jour for most enterprise organizaIons, as they struggle to keep up with the rapidly changing threat landscape and barrage of aAacks from money-hungry cybercriminals and hackers. IT teams, cyber and info-sec departments, CISOs and CIOs are leO feeling like they’re stuck in a giant revolving door that rotates between states of secure and insecure in their environments. Ransomware is the latest in a line of threats to come rolling down their internet connecIon causing that door to spin so fast everything becomes a sickening blur. It’s hardly surprising ransomware has become so ubiquitous and successful because of it’s frankly impressive ability to evolve. It sneaks past exisIng defenses like secure email gateways and desktop anI- virus with ease, then tricks users into running its viral payload themselves for that added killer punch. All of this, on top of our end-users facing other threats such as phishing, vishing, whaling (or business email compromise), plain old spam, malware and internet-villainy. Just when we thought we’d escaped the latest in that long list of threats, along comes ransomware to test out defenses and preparedness to the max.

Upload: others

Post on 24-May-2020

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Making Recovery Part of your Ransomware Preparedness Strategy A Execuve Brief · 2020-05-18 · Execuve Brief ® Making Recovery Part of your Ransomware Preparedness Strategy The

A

Execu(ve Brief

®

Making Recovery Part of your Ransomware Preparedness Strategy

TheCostPoten+alinRansomware

Today,ransomwareisabusiness–yes,business.Drivenmostlythroughransomware-as-a-servicepla<ormsrunbyorganizedcrimegangs,ransomwareisthefastestgrowingthreattoday.Andit’snosurprise,givenasingleransomwareaAackcampaigncannetthecriminalsmillionsofdollars,inreturnforveryliAlerisk,expenditureorchancesofbeingcaught.Thefollowingstatswillgiveyousomeideaofthecostofransomware:Revenue(annually): $1Billion+InfecIons: 4000+dailyAvg.Ransom: 3-5Bitcoins

(inUSD): $3500-6000Avg.Impact: 6worksta+ons

2serversAvg.DownIme: 12hoursAvg.RemediaIon: 12hours

Sources:FBI,KnowBe4Survey

Ransomware:Today’sThreatRealityRansomwarehasbecomethethreat-du-jourformostenterpriseorganizaIons,astheystruggletokeepupwiththerapidlychangingthreatlandscapeandbarrageofaAacksfrommoney-hungrycybercriminalsandhackers.ITteams,cyberandinfo-secdepartments,CISOsandCIOsareleOfeelinglikethey’restuckinagiantrevolvingdoorthatrotatesbetweenstatesofsecureandinsecureintheirenvironments.RansomwareisthelatestinalineofthreatstocomerollingdowntheirinternetconnecIoncausingthatdoortospinsofasteverythingbecomesasickeningblur.It’shardlysurprisingransomwarehasbecomesoubiquitousandsuccessfulbecauseofit’sfranklyimpressiveabilitytoevolve.ItsneakspastexisIngdefenseslikesecureemailgatewaysanddesktopanI-viruswithease,thentricksusersintorunningitsviralpayloadthemselvesforthataddedkillerpunch.Allofthis,ontopofourend-usersfacingotherthreatssuchasphishing,vishing,whaling(orbusinessemailcompromise),plainoldspam,malwareandinternet-villainy.Justwhenwethoughtwe’descapedthelatestinthatlonglistofthreats,alongcomesransomwaretotestoutdefensesandpreparednesstothemax.

Page 2: Making Recovery Part of your Ransomware Preparedness Strategy A Execuve Brief · 2020-05-18 · Execuve Brief ® Making Recovery Part of your Ransomware Preparedness Strategy The

Making Recovery Part of your Ransomware Preparedness Strategy 2

IfthissoundslikeyouoryourorganizaIon,thenyou’renotalone.RansomwareaAacksorganizaIonsofeverysize,geography,andindustryverIcal,althoughsomeindustriesarehitharder,givenanassumpIonthattheirdataismovevaluabletotheoperaIonalabilityofthebusiness.ThefrustraIonofthoseaffectedbytheseproblemsispalpable,andmostarenowlookingatabroadercrosssecIonoftechnologiestoprotectthemselvesandimportantlytorecoverpost-a:ack,ratherthanrelyonpure-playsecuritysoluIonsalone.MethodsofEntryRansomwareneedsameansofentry,somemethodofdelivery,andanabilitytoexecute.Likemostmalware,ransomwarefindsitswayintoanorganizaIonthrougheitheremailormaliciouslycodedwebsites.Thecodeusedatthispointismerelyatrojan–somekindofcodethatisacceptedbytheOSasavalidtypeofcodethatanemailmightcontain,orwebsitemightneedtorun.Oncethetrojanislaunched,itneedsawaytodownloadanddelivertheransomware.Atthispoint,trojansrelyonmacros(likethosefoundinWordandExcel),javascript,andevenvulnerabiliIesfoundinJava,Flash,webbrowsers,andbrowserplugins.LikesecuritysoOwarevendorswhostrivetoimprovetheirproductwitheachpassingrelease,cybercriminals

workIrelesslytoimprovetheir“product”aswell.UsingsophisIcatedandwhatcanonlybeconsidered“long-tail”methods–wheremulIplestepsaretakentobothavoiddetecIonandensureexecuIonoftheransomware–ransomwareauthorsareprovingthemselvestobeaformidableadversary.AndwithsocialengineeringandunsuspecIngemployeesontheirside,theredoesn’tappeartobeanyendinsightforransomwareinthenearfuture.PreparingforRansomwareAssumingit’sawhenandnotanifransomwarewillstrike,it’scriIcaltohaveyourITorganizaIonprepareineverywaypossible,toeitherthwartanaAack,ortominimizeitsimpactwithintheorganizaIon.Thereareafewcommonrecommendedsteps:1.   Patcheverything,patcho3enAccordingtothe2016VerizonDataBreachInvesIgaIonsReport,theaverageImetodevelopanexploittoapublishedvulnerabilityisonly30days.AndwithaAackstodayleveragingvulnerabiliIesthathavebeenout,literally,since1998(1998!),it’sevidentthattheeverythingpartoftherecommendedstepsisnotbeingtakenseriously.

Page 3: Making Recovery Part of your Ransomware Preparedness Strategy A Execuve Brief · 2020-05-18 · Execuve Brief ® Making Recovery Part of your Ransomware Preparedness Strategy The

Making Recovery Part of your Ransomware Preparedness Strategy 3

2.Useamul:-layereddefensestrategyManyorganizaIonsputtheirtrustinanIvirussoluIons,whichrelyonsignaturesandbehaviorstoidenIfymaliciously-intenIonalcode.ButgivenmalwareauthorsnotonlyarefamiliarwithhowAVworks,butintenIonallystudyhowspecificAVvendorsdetectmalware,andwritecodethatavoidsdetecIonbyusingcurrentAVsoFwaretotestagainst.What’sneededisacombinaIonofanIvirus,emailprotecIon,endpointprotecIon(e.g.applicaIonwhite/blacklisIng),leastprivilege,usertraining,andphishingtesIng.PartofthelayeredapproachincludessomeabilitytoidenIfythepresenceofmalware/ransomwareandnoIfyITsothattheinstancecanbeisolatedanderadicated.3.PlanningtheroadtorecoveryYourransomwarepreparednessandprotecIonstrategiescan’tsimplycontainstepsthataredesignedtostopransomwarefromenteringtheorganizaIon;tobetrulyprepared,yourplanmustincludemeasuresthatallowyoutoputanymanipulateddataandsystemsbackintoaproducIve,pre-ransomwarestate.Youmightthinkitcheapertosimplypaytheransom,however,becausewe’retalkingaboutdatabeingtrulymodified,youdon’twantthesuccessofyourrecoveryresIngontrusIng

criminalsthatyourdatawillbedecryptedperfectly,withdataintegrityperfectlymaintained.Relyingondatarecoveryfromyourowntestedbackupsprovides100%confidenceinyourrecoverability.Also,there’ssIlltheissueofremovingtheransomwareandtrojansonyoursystems.AccordingtoarecentCitrixsurvey,36%oforganizaIonsarenotconfidenttheycancompletelyeradicatemalwarefromsystems.Sowhat’sneededforrecovery?•  Recoverserverdata–Many

variantsofransomwareconnectfromtheinfecteduserdeviceouttoanyserversitcanreachviaexisIngorcachedSMBconnecIons,therebyallowittoencryptfilesonmulIpleservers.TobecertaindataisbackinaproducIonstate,recoveringanymanipulateddataisnecessary.Becauseyoucan’tknowtheextentofanaAackunIlitoccurs,ensuringallcriIcalfiles–bothuserandsystem–areincludedaspartofyourbackupandrecoverystrategy.

•  Aplanforuserdevices–whetherlaptopsordesktopworkstaIons,thesedevicesneedtobecompletelyreimagedtoensureanymalwareremnantisremoved.DevicesusedbycriIcalusersmayneedimage-levelbackupsoftheirowntogetthoseusersbackupandworkingquickly.OtherusersmaysimplyberecoveredusingaredeployedstandardworkstaIonimage.


Ransomware: The Known and Unknown€¦ · Can I get ransomware from removable devices? Can I get ransomware from social media? Can a hacker infect me with ransomware through other

Ransomware Threat Report : WannaCry · Ransomware Threat Report : WannaCry IN-DEPTH COVERAGE AND INSIGHTS OF THE WANNACRY RANSOMWARE FROM ARMOR’S SECURITY EXPERTS

Protecting Against Ransomware

A QUICK GUIDE FOR RANSOMWARE DEFENSE · 2019-03-02 · A QUICK GUIDE FOR RANSOMWARE DEFENSE | 2 A BRIEF HISTORY OF RANSOMWARE Before understanding how to defend against ransomware,

UNMASKING RANSOMWARE

Ransomware: Wannacry

Ransomware Cyber Threat Acronis Infographicdownload.acronis.com/...Ransomware_Threat_Acronis... · RANSOMWARE THE NEW CYBER THREAT AND HOW TO STOP IT RANSOMWARE: hackers hold your

Ransomware by lokesh

Understanding Crypto-Ransomware

Cisco Ransomware Overview (with video) · Cisco Ransomware Defense Solutions. Ransomware is a Massive Market Size of the ransomware market –$1B and growing $1B $209M in Q1 CY2016

CROWDSTRIKE // WHITE PAPER RANSOMWARE A GROWING …€¦ · CROWDSTRIKE // WHITE PAPER RANSOMWARE A GROWING ENTERPRISE THREAT ... the sheer volume of ransomware variants released

Execuve Summary & Analysis · 2018. 10. 24. · 2 28TH Annual Pennsylvania Economic Survey pachamber.org Execuve Summary & Analysis 28th Annual Pennsylvania Economic Survey Conducted

Threat Alert NotPetya Ransomware Attack...The NotPetya Ransomware Attack June 2017 A Deep Dive into the NotPetya Ransomware Attack This is a new variant of the Petya ransomware family

Business Guide to Ransomware - IT Best of Breed · 2017-05-15 · Business Guide to Ransomware Table of Contents: 1. Introduction to Ransomware 2. Ransomware as a Service 3. Dissection

Ransomware ly

RANSOMWARE - eset.com

Defend Your Data from Ransomware Attacksdiscover.zyxel.com/rs/471-TTL-126/images/Ransomware...Defend Your Data from Ransomware Attacks The Threat of Ransomware The WannaCry attack

Easy way to uninstall PadCrypt ransomware: Remove PadCrypt ransomware

LockBit Ransomware

Ransomware: Modern Day PiratesRansomware • What is ransomware • History of ransomware • Actors and their motivations • Anatomy of a ransomware attack • Cost of a ransomware

Ransomware Tips to Help Avoid Ransomware Attacks · 2019. 5. 8. · installed the ransomware. Tips to Help Avoid Ransomware Attacks 1. Don’t click. Visiting unsafe, suspicious or

Cybercrime Tactics & Techniques: Q2 2019 Ransomware ......Ransomware shifts to business targets » Consumer ransomware drops -12% YoY & -25% QoQ » Business focused ransomware increase

Understanding Ransomware: Impact, Evolution and Defensive ...€¦ · 14/07/2014  · 3 Evolution of Ransomware 3.1 Historic Examples of Ransomware Ransomware trojans appeared as

Ransomware- success stories Triangle InfoSeCon · Ransomware Ransomware WannaCry,Petya,CryptoLocker,and TeslaCrypt are some of the more notable examples of such ransomware. In general,

Cybersecurity Preparedness: The Legal Landscape and Incident Response Survival Guide · 2018-06-01 · –Review current data security threats and trends § Ransomware, W-2 incidents,

RANSOMWARE PROTECTION€¦ · RANSOMWARE PROTECTION UIDE . ... Exploitation Exploit Mitigations Application Behavior Payload Execution ... PREVENTION AGAINST RANSOMWARE

Ransomware Handbook

Thermostat Ransomware

Ransomware and tips to prevent ransomware attacks

Ransomware Payment: Legality, Logistics, …...• Ransomware start-up costs are cheap. Ransomware software is readily and easily available – and is extraordinarily inexpensive

Conti Ransomware

Ransomware infographicITU - itu.int · ransomware detections were flagged as crypto-ransomware. a 27% increase since it was discovered. A ransomware variant seen in Russia that zipped

Execuve (( Doctorate(in(Business(Administra&on(...Execuve ((Doctorate(in(Business(Administra&on(Michel’Kalika Genève,21novembre2013 Turn(Your(Experience(into(Knowledgeand( ShareIt

AtomSilo Ransomware

Ransomware: your money or your bytes Version 2.0, updated ...€¦ · Center joint Ransomware Guide6 • Microsoft - Human-operated ransomware attacks: A preventable disaster7 •