Ransomware is the fastest growing malware threat, targeting users of all types—from the home user to the corporate network. On average, more than 4,000 ransomware attacks have occurred daily since January 1, 2016.
This is a 300-percent increase over the approximately 1,000 attacks per day seen in 2015. There are very effective prevention and response actions that can significantly mitigate the risk posed to you and your organization.
Ransomware targets home users, businesses, and government networks and can lead to temporary or permanent loss of sensitive or proprietary information, disruption to regular operations, financial losses incurred to restore systems and files, and potential harm to an organization’s reputation.
Ransomware will direct a user to click on a link to pay a ransom; however, the link may be malicious and could lead to additional malware infections.
► HOW DO I RESPOND TO RANSOMWARE?
Implement your security incident response and business continuity plan. It may take time for your organization’s IT professionals to isolate and remove the ransomware threat to your systems and restore data and normal operations.
In the meantime, you should take steps to maintain your organization’s essential functions according to your business continuity plan. Organizations should maintain and regularly test backup plans, disaster recovery plans, and business continuity procedures.
Contact law enforcement immediately. We encourage you to contact a local FBI or USSS field office immediately to report a ransomware event and request assistance.
There are serious risks to consider before paying the ransom. Law enforcement agencies do not encourage paying the ransom. They understand that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers. As you contemplate this choice, consider the following risks:
♦ Paying a ransom does not guarantee that you will regain access to your data; in fact, some individuals or organizations were never provided with decryption keys after having paid a ransom.
♦ Some victims who paid the demand have reported being targeted again by the same criminals.
♦ After paying the originally demanded ransom, some victims have been asked to pay more to get the promised decryption key.
♦ Paying could inadvertently encourage this criminal business model.
► HOW DO I PROTECT MY NETWORKS?
Prevention is the most effective defense against ransomware and it is critical to take precautions for protection. Infections can be devastating to an individual or organization, and recovery may be a difficult process requiring the services of a reputable data recovery specialist.
► Preventive Measures:
♦ Implement an awareness and training program. Because end users are targets, employees and individuals should be aware of the threat of ransomware and how it is delivered.
Attackers often enter the organization by tricking a user to disclose a password or click on a virus-laden email attachment. Remind employees to never click unsolicited links or open unsolicited attachments in emails.
To improve workforce awareness, the internal security team may test the training of an organization’s workforce with simulated phishing emails.
♦ Enable strong spam filters to prevent phishing emails from reaching the end users and authenticate inbound email using technologies like Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and Domain Keys Identified Mail (DKIM) to prevent email spoofing.
♦ Scan all incoming and outgoing emails to detect threats and filter executable files from reaching end users.
♦ Configure firewalls to block access to known malicious IP addresses.
♦ Patch operating systems, software, and firmware on devices. Consider using a centralized patch management system.
♦ Set anti-virus and anti-malware programs to conduct regular scans automatically.
♦ Manage the use of privileged accounts based on the principle of least privilege: no users should be assigned administrative access unless absolutely needed; and those with a need for administrator accounts should only use them when necessary.
♦ Configure access controls—including file, directory, and network share permissions— with least privilege in mind. If a user only needs to read specific files, the user should not have write access to those files, directories, or shares.
♦ Disable macro scripts from office files transmitted via email. Consider using Office Viewer software to open Microsoft Office files transmitted via email instead of full office suite applications.
♦ Implement Software Restriction Policies (SRP) or other controls to prevent programs from executing from common ransomware locations, such as temporary folders supporting popular Internet browsers or compression/decompression programs, including the AppData/LocalAppData folder.
♦ Consider disabling Remote Desktop protocol (RDP) if it is not being used.
♦ Use application whitelisting, which only allows systems to execute programs known and
permitted by security policy.
♦Execute operating system environments or specific programs in a virtualized environment.
♦ Categorize data based on organizational value and implement physical and logical separation of networks and data for different organizational units.
► Business Continuity Considerations
A commitment to cyber hygiene and best practices is critical to protecting your networks. Here are some questions you may want to ask of your organization to help prevent ransomware attacks:
♦ Risk Analysis: Have we conducted a cyber security risk analysis of the organization?
♦ Are we able to sustain business operations without access to certain systems? For how long? Have we tested this?
♦ Back up data regularly. Verify the integrity of those backups and test the restoration process to ensure it is working. Secure your backups and make sure backups are not connected permanently to the computers and networks they are backing up.
Secure backups to the cloud or physically store backups offline. Some instances of ransomware have the capability to lock cloud-based backups when systems continuously back up in real time, also known as persistent synchronization.
Backups are critical in ransomware recovery and response; if you become a victim, a backup may be the only way to recover your critical data.
♦ Conduct an annual penetration test and vulnerability assessment. Have you attempted to hack into our own systems to test the security of your systems and your ability to defend against attacks?
♦ Vulnerability Patching: Have you implemented appropriate patching of known system vulnerabilities?
♦ Application Whitelisting: Do you allow only approved programs to run on your networks?
♦ Incident Response: Do you have an incident response plan and has it been tested?
Ransomware is a growing criminal activity involving numerous variants. Ransomware variants have become more sophisticated and destructive. Some variants encrypt not just the files on the infected device, but also the contents of shared or networked drives, externally attached storage media devices, and cloud storage services that are mapped to infected computers.
Recent federal investigations reveal that ransomware authors continue to improve ransomware code by using anonymizing services like “Tor 3” for end-to-end communication to infected systems and Bitcoin virtual currency to collect ransom payments.
GiliSoft Full Disk Encryption is especially useful for laptops and other small computing devices that can be physically lost or stolen. It offers encryption of all disk partitions, including the system partition. Through password protecting a disk, disk partition or operating system launch, the program disables any unauthorized reading/writing activity on your disk or PC, restricts access and launch of specific disks and files. It provides automatic security for all information on endpoint hard drives, including user data, operating system files and temporary and erased files. For maximum data protection, multi-factor pre-boot authentication ensures user identity, while encryption prevents data loss from theft.
Cloud Storage Solutions:
Data Recovery Solutions:
Anti-Virus / Anti-Malware Solutions: