How Should Companies Handle Ransomware?
Significant interruptions were created to supply chains and company operations in 2021 as a result of high-profile ransomware attacks such as the Colonial Pipeline and Kaseya intrusions.
In addition to these high-profile intrusions, ransomware attacks have generally become more widespread. [Case in point:] [Case in point:] [Case in point Because of the proliferation of ransomware offered as a service, often known as RaaS, several cybercriminal organisations now have access to high-quality software. Because ransomware has become so pervasive and lucrative, any firm, no matter how large or little, is at risk of being a victim. Research conducted by Check Point indicates that the number of ransomware assaults increased by 93% between June of 2020 and June of 2021.
The Dangers Involved With Ransomware
Malware like ransomware is created specifically to wreak havoc on an organisation and its operations. Cybercriminals have several options at their disposal to demand a ransom when faced with modern ransomware since it both exfiltrates and encrypts the sensitive data of a corporation. There have been instances when ransomware gangs have expanded its activities to target the consumers of a firm as well.
An assault using ransomware presents major dangers to a company or organisation. For failing to secure sensitive data, in addition to the expenses associated with lost productivity and remediating the event, a firm may suffer harm to its brand, experience a loss of customers, and be subject to legal and regulatory fines.
How Should a Business Approach the Ransomware Threat?
An assault using ransomware may result in severe downtime for a business, in addition to hefty additional expenses and losses. It is critical to act in an effective manner when confronted with a ransomware infestation in order to reduce the amount of harm caused.
#1. Safety and Precautionary Measures
After ransomware has begun encrypting data, the harm that it will do is already done. Even if a ransom is paid, a business may not be able to retrieve all of its information from its backups, which will result in the loss of some data. In addition, it is usual for current ransomware to steal and exfiltrate data before encrypting it, which means that the firm has probably previously been the victim of a data breach.
The best method to deal with the risk posed by ransomware is to take preventative measures. A firm may defend itself against ransomware in a number of different methods, some of which include the following:
Patch Management: Some varieties of ransomware are designed to propagate by exploiting vulnerabilities for which fixes are already available. Patches may be downloaded here. Installing software updates and patches as soon as they become available may be an effective method for blocking certain attack vectors.
Phishing Defense: Phishing is one of the most prevalent distribution tactics for ransomware. Phishing defence is essential. Companies should provide their staff with training to help them recognise phishing efforts and react appropriately to them, and they should also implement anti-phishing technologies to prevent harmful communications from reaching workers' inboxes.
Access Management: With the increase of remote work, fraudsters are increasingly using compromised credentials and secure remote access solutions to plant and execute their malware. This is a growing trend in the industry of access management. Implementing multi-factor authentication (also known as MFA) and limiting access in accordance with the principle of least privilege are two strategies that may assist avoid and lessen the impact of attacks of this kind.
Anti-Ransomware: If ransomware is able to infiltrate business systems, it is important to identify and remove it as quickly as possible in order to minimise the amount of damage it may do. Anti-ransomware software should be installed on every device used in a company's operations so that malicious software may be recognised and removed before it can steal or encrypt critical data.
By blocking off these possible entry points, you may assist to lessen the likelihood of a ransomware assault occurring. If a ransomware attack does take place, however, reinforcing these measures with a robust backup strategy may assist to mitigate some of the damage caused by the assault.
#2. Incident Response
A prompt reaction to a ransomware outbreak may assist to lessen the effect of a successful attack and the costs associated with it. An company has to have an incident response team (IRT) and plan in place before they are required to use them in order to ensure a prompt and successful response. Incident responders need to keep the following in mind while dealing with a ransomware infection:
Be Calm Infections with ransomware may be frightening, but it is imperative that you do not panic when they occur. Maintain your composure, act in accordance with the incident response plan, and take a photo of the ransom letter so that it may be accessed by law enforcement and further investigators in the event that more questions arise in the future.
Stop the Spread of the Infection Because certain variants of ransomware try to replicate themselves by infecting corporate networks, you should remove affected computers from the network as soon as you can. In addition to this, you should follow the attack chain backwards to check that the attacker does not have a presence on any other systems.
Keeping an eye on the system's status is important since ransomware may put a computer in an unstable condition, and any modifications made to the system might result in the loss of data. Do not attempt to restart infected workstations, apply updates, or carry out any other kind of routine system maintenance.
Do Not Touch Backups: It is typical practise for ransomware to try to infect backups in order to coerce businesses into paying the demanded ransom. Do not link backups to computers that have been attacked with ransomware until the virus has been completely removed and the backups' integrity has been validated.
Coordination with Interested Parties : In the battle against ransomware, collaboration is very necessary. Do not be hesitant to get in touch with the local police enforcement or to make contact with a reliable incident response service in order to get assistance in resolving the situation.
3. Elimination and Recuperation
The next phase in the process is recovery, which comes after putting a stop to the spread of the ransomware and conducting an investigation into the occurrence. After the ransomware has been removed, the most important option to make at this point is whether to pay the demanded sum or to try to restore the data from a backup.
Paying the ransom should only be done as a last option, despite the fact that it could seem to be the solution that is simplest and most cost-effective. If you pay the ransom, there is no assurance that your data will be retrieved, and you will be helping the attackers finance future attacks with your money. Before determining whether or not to pay a ransom that may be in the hundreds of thousands or even millions of dollars, it is important to determine whether or not the data can be retrieved from backups and whether or not the ransomware has a decryptor.
How Check Point Can Be of Assistance
The most effective strategy for mitigating the risk posed by ransomware is to take preventative measures and engage in proactive planning. For additional information on ransomware attacks as well as best practises for guarding against the ransomware threat, be sure to check out the research that Gartner published titled "How to Prepare for Ransomware Attacks."
Post a Comment