Three Steps To Protect Your Organisation From Wiper Malware

Wiper malware is an alarming threat to corporate data. Unlike ransomware, which can encrypt and disable your files until you pay a ransom, wiper malware aims to delete your data permanently and cause as much destruction as possible.

Once it infects your system, it will make your data completely unrecoverable. This type of malware is hazardous because it offers no possibility of recovery by paying a ransom.

Wiper malware has grown more common in recent years, with several high-profile attacks making headlines. The destructive WannaCry attack in 2017, which affected hundreds of thousands of computers worldwide, is believed to have been a wiper attack.

Other notable recent wiper attacks include Olympic Destroyer in 2018, targeted at the Winter Olympics in South Korea, and ZeroCleare in 2020, targeted at the energy and industrial sectors in the Middle East. Even the infamous Sony Pictures hack was a wiper attack.

Wiper malware is also a weapon of cyber warfare. As the conflict between Russia and Ukraine continues, Ukraine has seen a withering barrage of wiper attacks. Recently, researchers at Fortinet reported that criminals deployed wiper malware against other countries. In the first half of 2022, seven new wiper variants were used in campaigns against private, government, and military organizations. Indeed, there have been wiper malware attacks in 24 countries beyond Ukraine, with some of these attacks targeting critical infrastructure using disk-wiping malware.

One of the fundamental challenges in dealing with wiper threats is that they’re very often difficult to detect and contain.

Unlike other forms of malware, which usually come with signs of their presence, wipers erase all traces of themselves once they have completed their destructive work. It makes it difficult for IT security professionals to respond to these attacks and prevent them from spreading.

Organisations must implement robust, multi-layered security measures, including regular backups of critical data to defend against wiper threats. It’s also essential to maintain a strong security posture and be alert to signs of a potential wiper attack.

Here are three steps your organisation can take to minimise your risk of falling victim to these destructive attacks.

1: Backup your data:   The importance of backing up your data cannot be overstated when defending against wiper malware. While backups can’t prevent an attack from occurring, they provide a lifeline for restoring compromised data caused by wiper malware—or any other type of attack.

By properly managing your backups, you can ensure you have copies of your data that are separate from your production systems. Should wiper malware, ransomware, or any other malware strike the active IT environment, your business can turn to its backups, stored on an immutable storage solution, for restoration.

Not only is restoring from backups more cost-effective and faster than paying a ransom to recover data, but it’s likely your only recourse in a wiper attack because paying a ransom is usually not an option.

2: Follow the 3-2-1-1 rule:   A 3-2-1-1 data-protection strategy is a best practice for defending against malware, including wiper attacks. This strategy entails maintaining three copies of your data, on two different media types, with one copy stored offsite. The final 1 in the equation is immutable object storage. Let’s break down the advantages of the 3-2-1-1 strategy.

  • By maintaining multiple copies of your data, you can ensure that you have a backup available in case one copy is lost or corrupted. It is imperative in the event of a wiper attack, which destroys or erases data.
  • Storing your data on different media types also helps protect against wiper attacks. For example, you might keep one copy of your data on a hard drive, another at a cloud-based storage service, and the third on a removable drive or tape. This way, if one type of media is compromised, you still have access to your data through the other copies.
  • Keeping at least one copy of your data offsite, either in a physical location or in the cloud, provides an additional layer of protection. If a wiper attack destroys on-site copies of your data, you’ll still have access to your offsite backup.
  • The final advantage is immutable object storage. Immutable object storage involves continuously taking snapshots of your data every 90 seconds, ensuring that you can quickly recover it even during a wiper attack. This next-generation data-security tool helps to safeguard your information and protect it from loss or damage.

3: Air gap your networks:   Air gapping is an efficient and effective method for protecting backup data against wiper attacks. There are two types of air gapping: traditional physical and logical air gapping. Physical air gapping involves disconnecting a digital asset from all other devices and networks, creating a physical separation between a secure network and any other computer or network. You can store backup data on media such as tape or disk, then completely disconnect these media from your production IT environment.

Logical air gapping, on the other hand, relies on network and user-access controls to isolate backup data from the production IT environment. Data is pushed to its intended destination, such as an immutable storage or custom appliance, through a one-way street and can only be managed or modified through separate authentication channels.

The beauty of air gapping is that it renders your data almost invisible to wiper malware attacks, making it nearly impossible for the bad guys to compromise your backups.

Final Takeaway

The increasing spread of wiper malware in the wild is a stark reminder of the dangerous landscape organisations face when protecting their data. A solid, well-managed data backup and recovery plan is the key to ensuring data safety in the face of today’s growing array of threats.

No matter what tactics cybercriminals may use to disrupt your access to your data, a robust backup and recovery plan will keep your data secure.

Florian Malecki is Executive Vice President of Marketing at Arcserve

You Might Also Read:  

Five Data Security Trends Organisations Must Deal With:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« The Internet of Vehicles - Connected Cars
NATO - AI Cyber Attacks Are A Critical Threat »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Cofense

Cofense

Cofense (formerly PhishMe) is a leading provider of human-driven phishing defense solutions.

Government Communications Headquarters (GCHQ)

Government Communications Headquarters (GCHQ)

GCHQ defends Government systems from cyber threat, provide support to the Armed Forces and strive to keep the public safe, in real life and online.

CSI

CSI

CSI is a Managed Service Provider (MSP) delivering Hybrid Multi-Cloud, Data Protection, and Cyber Security solutions to highly regulated industries.

NetDiligence

NetDiligence

NetDiligence is a privately-held cyber risk assessment and data breach services company.

Eseye

Eseye

Eseye is a global specialist supplier of cellular internet connectivity for intelligent IoT (Internet of Things) devices.

Philippine National Police Anti-Cybercrime Group (PNP-ACG)

Philippine National Police Anti-Cybercrime Group (PNP-ACG)

The mission of the PNP Anti-Cybercrime Group is to implement and enforce pertinent laws on cybercrime and other cyber related crimes and pursue an effective anti-cybercrime campaign.

Novastor

Novastor

NovaStor® is an award-winning, international data backup and recovery software company with solutions supporting physical, virtual and cloud environments.

Consensys

Consensys

ConsenSys is a global blockchain company. We develop enterprise applications, invest in startups, build developer tools, and offer blockchain education.

National Cybersecurity Competence Centre (NC3)

National Cybersecurity Competence Centre (NC3)

NC3 has been established in response to growing demands for practically applicable products and solutions for ensuring cybersecurity of critical and non-critical information infrastructures.

Jobsite

Jobsite

Jobsite is an award winning job board in the UK providing job listings in the key sectors of IT, Engineering and Finance.

Cybil

Cybil

Cybil is a publicly-available portal where members of the international cyber capacity building community can find and share information to support the design and delivery of programs and projects.

TierPoint

TierPoint

TierPoint delivers secure, reliable, and connected infrastructure solutions at the internet’s edge. We meet you where you are in your journey to solve for data storage, compute, and recovery.

ThriveDX

ThriveDX

ThriveDX, the world’s premier EdTech provider (formerly HackerU), champions digital transformation training as a means of empowering individuals to thrive in the age of digital disruption.

C3i Hub

C3i Hub

C3i Hub aims to address the issue of cyber security of cyber physical systems in its entirety, from analysing security vulnerabilities to developing tools and technologies.

Componolit

Componolit

Componolit GmbH is a highly specialized company with a strong emphasis on trustworthy software, component-based systems and formal verification.

A76

A76

A76 offers a range of highly specialized services to protect your business.