Ransomware And Its Criminal Use

Ransomware is a type of malicious software cyber criminals use to block you from accessing your own data. The digital extortionists encrypt the files on your system and add extensions to the attacked data and hold them ‘hostage’ until the demanded ransom is paid. After the initial infection, the ransomware may attempt to spread throughout your network to shared drives, servers, attached computers, and other accessible systems. 

If the ransom demands are not met within the cyber criminals' timeframe, the system or encrypted data remains unavailable, or your data may be deleted by the software and the decryption key obliterated. 

How Ransomware Works

There are a number of vectors ransomware can take to access a computer. One of the most common delivery systems is phishing email, this is an attachment that come to the victim in an email, masquerading as a file they should trust. Once they're downloaded and opened, they can take over the victim's computer.

Ransomware enters your network in a variety of ways, the most popular is a download via a spam email attachment. The download then launches the ransomware program that attacks your system. 

Other forms of entry include social engineering, downloads of the malicious software from the web that can be direct from a site or by clicking on “malvertising,” fake ads that unleash the ransomware. The malware can also be spread through chat messages or even removable USB drives.

Typically, the software gets introduced to your network by an executable file that may have been in a zip folder or disguised as a fax or other viable attachment. The download file then encrypts your data, adds an extension to your files and makes them inaccessible. 

More sophisticated versions of the software are propagating themselves and can work without any human action. Known as “drive-by” attacks, this form of ransomware infects your system though vulnerabilities in various browser plugins.
Without ponying up the money for the key, it is very difficult to decrypt files after an attack. Of course, good backup eliminates the need to succumb to ransomware demands.

Ransomware attackers are honing their distribution plans to hit those organizations that are more likely to pay the ransom demand ,such as healthcare, government, education and small businesses.

How To Defend Against Ransomware

Whether you need to know how defend against CryptoLocker or any of the other 4,000 daily attacks, the first component of the solution is to warn co-workers against downloading suspicious file attachments. They won’t prevent all attacks, but it will help. It is also critical to ensure that your servers are being patched regularly, as many security gaps that ransomware hackers take advantage of are often protected in the latest Microsoft patches.  

Failing to stay up to date can cause major issues down the line.  No matter what, you have to prepare to be hit.  So it’s critical you not only have backups, but secure, tested backups and a well-documented, secure disaster recovery plan if the attack is pervasive enough.  On the data protection side of things, keep these 5 components in mind:

Backup & Protect 

Experts have suggested a number of ways private individuals and organisations can protect their computer systems against cyber-attacks. Blocking suspicious Internet and email accounts and avoiding downloading programs that are not secure are some of the cheap and effective ways of protecting against ransomware, but will not block all forms of the software.

Organisations are warned to back up data on separate networks or on a cloud-based system to ensure continuity of business, should a successful attack be carried out. 

Follow the 3-2-1- rule. Three copies of your data, 2 different types of media and 1 version stored off-site. If you do get hit by ransomware you’ll have an easy escape.  You can even consider keeping a backup offline (on tape or rotational media), but recovery times are longer from offline backups, and offline backups are more difficult to test.

Secure

Ransomware predominantly targets Windows OS. As backup systems can require many role-based instances for centralised management, data movement, reporting, search and analytics, securing all those machines can be complex. Consider locking them down to do only what they are required, and nothing more. Newer solutions based on integrated backup appliances typically remove that complexity and come hardened out of the factory.So security can be far simpler in those newer architectures.

Test

Test the viability of your backup and disaster recovery strategy regularly. A lot of factors can impact recovery, including backups of machines that already contain ransomware.  Test automation is becoming a trend in the data management and data protection industry. It is important those features are used more as security threats become more impactful to IT.

Detect

Early ransomware detection means faster recovery. More backup vendors are starting to use predictive analytics and machine learning to recognize possible attacks and alert administrators of abnormal fluctuations of data as backups are ingested.

Recovery

If you’ve effectively backed up your data and tested its recoverability you will be ready to roll back your network to a safe restore point and avoid downtime, data failure and revenue loss.

Ransomware attackers are ferocious. If you haven’t been attacked yet, it’s not a matter of if, but when…be prepared.

Forbes:       Unitrends:       CSO Online:           Irish Examiner:         Washington Post

You Might Also Read:

Will Governments Ban Ransom Payments To Hackers?:

 

« Get The Best Cyber Security Audits & Training
Denmark Helped NSA Spy On European Union »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Veeam

Veeam

Veeam is the leader in intelligent data management for the Hyper-Available Enterprise.

National Cybersecurity and Communications Integration Center (NCCIC) - USA

National Cybersecurity and Communications Integration Center (NCCIC) - USA

NCCIC is a cyber situational awareness, incident response, and management center for the US Government, intelligence community, and law enforcement.

ActiveCyber

ActiveCyber

ActiveCyber is a source for news, reviews, learning, and technological innovation in the active cyber defense industry.

Beame.io

Beame.io

Beame.io is an information security company that distributes open source authentication infrastructure based on encryption.

Crypta Labs

Crypta Labs

Crypta Labs is an Award Winning IOT Security startup that is developing a quantum-based encryption chip to secure the Internet of Things.

Bolton Labs

Bolton Labs

Bolton Labs is a leading provider cybersecurity services, tools, and analysis for MSPs and organizations who want to scale their security offerings.

MER Group

MER Group

MER Group is a world-leading solutions provider specializing in Homeland Security (HLS), Cyber and Intelligence, Communication Infrastructure and Tactical Communication Systems.

US Venture Partners (USVP)

US Venture Partners (USVP)

USVP is a leading Silicon Valley venture capital firm focusing on early-stage start-ups that transform cybersecurity, enterprise software, consumer mobile and e-commerce, and healthcare.

WebOrion

WebOrion

WebOrion is an All-in-One Web Security & Performance Suite. Fortify, accelerate and monitor your website today.

Triaxiom Security

Triaxiom Security

Triaxiom Security offers penetration testing, security audits, and strategic consulting customized to meet your needs.

Cider Security

Cider Security

Cider Security - It’s time to revolutionize the way Security, Dev and DevOps teams work together to supercharge security at the speed of engineering.

ProArch

ProArch

ProArch is a global team of multidisciplinary experts in cloud, infrastructure, data analytics, cybersecurity, compliance, and software development.

CyberMaxx

CyberMaxx

At CyberMaxx, our approach to cybersecurity provides end-to-end coverage for our customers – we use offense to fuel defense.

Codenotary

Codenotary

Codenotary provide a comprehensive suite of verification and enforcement services to guarantee the integrity of your software throughout its entire lifecycle.

CyberForceHQ

CyberForceHQ

CyberForce helps cyber security professionals take real-world tests, get ranked and get paid better. It's that simple.

Repello AI

Repello AI

Repello - making AI safe to trust. We help you continuously red-team your GenAI applications against ever-evolving AI threat landscape.