Ransomware Attack Protection

Ransomware attacks are growing in size and frequency and are threatening businesses all around the world. As more employees return to offices after working from home for months on end, cyber security dangers are a big concerns.
 
The shift to remote working triggered by the pandemic has also underlined significant cyber security threats for employers and employees alike. Now,  the head of the UK’s National Cyber Security Centre has warned that ransomware has become the biggest threat to British people and businesses. 
 
In a speech being given by Lindy Cameron, chief executive of the NCSC  she highlighted the need for ransomware problem to be taken seriously, and warns of the “cumulative effect” if society fails to properly deal with the rising threat. “Far more worrying is the cumulative effect of a failure to manage cyber risk and the failure to take the threat of cyber criminality seriously. For the vast majority of UK citizens and businesses, and indeed for the vast majority of critical national infrastructure providers and government service providers, the primary key threat is not state actors but cyber criminals,” she said. 

In 2018 cyber criminals stole 8 billion Euros, in 2020 they had stolen over 20 billion Euros.

  • Ireland’s health-care system has been in disarray since May 14th when the Health Service Executive, the state-funded health-care provider, was hit by a ransomware attack which led it to shut down most of its computer systems. The attackers threatened to release stolen data, including confidential patient records, unless the Health Service paid €16.5m, which it has declined to do.
  • The Colonial Pipeline attack shut down a system which delivers 45 percent of all the fuel to the US Eastern Seaboard, and the week-long ransomware attack caused public havoc with gas shortages on the East coast. The company confirmed that it paid $4.4 million in bitcoin to end the double-extortion ransomware attack, but i the FBI and managed to recover a substantial proportion of this. 
  • The highest reported payment targeting Travelex and the ransom settlement was thought to be about $6 million, though the exact amount remains unknown.  Another large 2020 ransomware demand involved the French construction firm Bouygues. The demanded sum was around $11.8 million.

How Ransomware Works 

Ransomware is a type of malware used by cyber criminals to make a lot of money. Malware, are software programs that enable cyber criminals to take over an electronic device once it is infected. The majority of ransomware attacks begin with phishing emails and the cyber criminals hide the malware in an attachment that poses as a benign file, like an invoice or a report. As soon as the victim opens the attachment, the ransomware spreads through their device, locking files and leaving behind a ransom note.

 

Once infected, there are numerous ways cyber criminals can leverage the victim’s system for profit, such as collecting credit card data which they then sell, harvesting logins and passwords to people’s bank accounts. They can then use the account to steal and transfer money, finding personal information which they leverage for identity fraud, or connect the victim’s computer into a botnet for attacks such as Distributed Denial of Service (DDoS) attacks. 

After cyber criminals infect a single computer in an organisation, they do not immediately demand a ransom. Instead, they use that infected system to stealthily infect other computers in the organisation, perhaps even the backups. Not until the cyber criminals believe almost every system has been infected, and not until they have exfiltrated an extensive amount of data will they then enable the ransomware, encrypt all the devices, and notify the organisation.
 
 Attackers will also threaten to publish data if payment is not made. To counter this, organisations should take measures to minimise the impact of data exfiltration.
 
Law enforcement agencies do not as a rule encourage the payment of ransom demands. If you do pay the ransom, there is no guarantee that you will get access to your data or computer. Furthermore, your computer system will still be infected and you are more likely to be targeted in the future. 
 
Ransomware has proven to be one of the fastest and more profitable than almost any other attack, but by teaching your people to spot phishing scams, you can prevent the majority of ransomware attacks.

Stopping Ransomware

In the highly developed world of cyber crime there are entire organisations dedicated to continually developing malware that cannot be detected. There are four general areas of vulnerability to ransomware infection that need to be carefully monitored: 
 
Social Engineering: These types of attacks, especially phishing, are one of the primary methods cyber attackers use to infect systems. Train people on how to spot and stop phishing attacks.
 
Passwords: Weak or insecure passwords are another very common way cyber attackers break into organisations today. Provide the training and tools to ensure people are using strong passwords.
 
Updating: Updated and current systems are much harder for cyber attackers to infect with malware. We want to ensure people are always using the most current operating systems and applications. In some cases, you may want to emphasise the importance of enabling automatic updating.
 
Training: Lessons for your workforce on how to report a suspected infected computer. Ensure they feel comfortable reporting, even if they know they caused the infection. 
 
As more employees return to offices after working from home for months on end, cyber security dangers are a big concern and every employee need to be aware of the risk of malware that could be waiting on their devices.
 
NCSC:      SANS:      Hornet Security:          Heimdal Security:     Cloudwards:      ITGovernance:
 
ZDNet:       Chain Analysis:    Komo News:      Economist:     Tripwire:     Legal Futures:        HLB
 
You Might Also Read: 
 
Negotiating Ransom: To Pay Or Not?:
 
 
« How To Write Learning Objectives For Cyber Security Training
Massive Attack: 200+ US Organisations Hacked »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Libraesva

Libraesva

Libraesva specialize in Email Security. From Email Security, Phishing Awareness and Email Archiver. We can assist you with any email issues you may have.

RiskLens

RiskLens

RiskLens is a software company that specializes in the quantification of cybersecurity risk.

Department of Energy - Cybersecurity, Energy Security, and Emergency Response (CESER)

Department of Energy - Cybersecurity, Energy Security, and Emergency Response (CESER)

The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) addresses the emerging threats of tomorrow while protecting the reliable flow of energy to Americans today.

Cycuity

Cycuity

Cycuity (formerly Tortuga Logic) is a cybersecurity company that is transforming the way we secure silicon with comprehensive hardware security assurance.

HumanFirewall

HumanFirewall

Your secuirty is dorectly proportional to the awareness of your employees. Use Phishing simulation across your organization to train & profile user behavior.

ISMS.online

ISMS.online

ISMS.online is a cloud software solution for fast & cost-effective implementation of an information security management system and achieve compliance with ISO 27001 and other standards.

FraudScope

FraudScope

FraudScope is an AI-assisted platform that accelerates the identification of fraud, waste, and abuse.

Partnership for Conflict, Crime and Security Research (PaCCS)

Partnership for Conflict, Crime and Security Research (PaCCS)

PaCCS delivers high quality and cutting edge research to improve our understanding of current and future global security challenges in areas including cybersecurity.

NodeSource

NodeSource

NodeSource helps organizations run production-ready Node.js applications with greater visibility into resource usage and enhanced awareness around application performance and security.

OSIbeyond

OSIbeyond

OSIbeyond provides comprehensive Managed IT Services to organizations in the Washington D.C., MD, and VA area including IT Help Desk Support, Cloud Solutions, Cybersecurity, and Technology Strategy.

Digital Craftsmen Ltd

Digital Craftsmen Ltd

We're ISO27001 & Cyber Essentials Cybersecurity experts, delivering full cloud security and managed services. We take a bespoke approach for each client from hosting, optimising & securing them online

Aura

Aura

Aura is a mission driven technology company dedicated to creating a safer internet for everyone. We’re making comprehensive digital security that's simple to understand and easy to use.

LogicGate

LogicGate

The LogicGate Risk Cloud™ is an agile GRC cloud solution that combines powerful functionality with intuitive design to enhance enterprise GRC programs.

Cycurion

Cycurion

Cycurion is a global leading provider of Network Communications and Information Technology Security Solutions.

VicOne

VicOne

With a vision to secure the vehicles of tomorrow, VicOne delivers a broad portfolio of cybersecurity software and services for the automotive industry.

Assetnote

Assetnote

The Assetnote platform enables organizations to effectively map and continuously monitor their external attack surface.