How to Prevent Ransomware

The Evolution of Ransomware

Ransomware began as malware that would encrypt the files on an infected computer using a secret key known only to the attacker. The ransomware operator would then demand a ransom in exchange for the decryption key.

Since then, the ransomware threat has evolved multiple times. One iteration was the introduction of “double extortion” attacks in which the attacker would both encrypt the data and steal it. The attacker would then threaten to leak the stolen data if the ransom wasn’t paid. Later versions of the attack extorted ransoms from the target’s customers or partners as well, coining the term “triple extortion”.

More recently, ransomware operators are skipping the encryption step entirely. The modern ransomware attack involves stealing sensitive data and threatening to expose on shame sites. Ransomware hackers will publish victim’s names and details to shame them and pressure them to pay ASAP.

How to Prevent Ransomware Attacks

Ransomware poses a significant threat to an organization’s business continuity as the consequences range from data loss, reputation damage, and unexpected financial burden. These best practices help organizations to manage their exposure to ransomware risks.

Address Infection Vectors

Ransomware has the ability to access an organization’s environment using a variety of methods. Best practices to protect against ransomware include:

• Strong Authentication: Ransomware operators use weak and breached passwords to access an organization’s systems via RDP and similar remote access tools. Enforcing multi-factor authentication (MFA) for all corporate systems makes it more difficult for an attacker to gain access.
• Vulnerability Management: Ransomware can exploit unpatched vulnerabilities to gain access to corporate systems. Regular vulnerability scanning and updates are able to close these security gaps and prevent them from being exploited.
• Employee Training: Phishing attacks are another common infection vector for malware. Employee training — combined with email and endpoint security solutions — can help to prevent these attacks from succeeding.
• Inventory Assets: You can’t protect assets that you don’t know exist. Security strategies should begin with a full assessment of an organization’s IT and OT assets, which may be the weakest security link.
• Assess Ransomware Risk: Ransomware attacks can use various attack vectors to infect an organization. Assess whether existing defenses align with security best practices and assess their effectiveness via penetration testing and compromise analysis.
• Stay On Guard 24/7: Cybercriminals don’t keep normal business hours and commonly take advantage of downtime such as weekends and holidays for their attack. Ensure that security monitoring and incident response are active 24/7.
• Watch for Pre-Ransomware: Trickbot, Emotet, Dridex, Cobalt Strike, and other trojan malware are commonly used to deliver ransomware. Infections by these malware should be addressed before they introduce additional security risks.

Implement Defense in Depth

A perimeter-based approach to security only works as long as the organization can keep the threat outside its network. Compromised credentials, insider threats, and various other security risks can sneak malware inside an organization’s network.

Defense in depth protects against an attacker from moving laterally once they’ve gained access to an organization’s network. Network segmentation and least-privilege access controls enable an organization to detect and block threats before they can reach sensitive and valuable resources.

Maintain Good Backups

While ransomware operators are focusing more on data extortion than data encryption, some ransomware will still encrypt files. In these cases, an organization may not be able to recover its files and data without the decryption key — and potentially not even then.

Creating regular backups ensures that an organization can restore its data when needed. These backups should be stored securely — in a read-only format if possible — and tested periodically to ensure that they are intact and usable.

Deploy Anti-Ransomware Solutions

Ransomware attacks are growing more common and sophisticated. Most companies will face these threats regularly, and some attacks will likely slip through the cracks.

In these cases, the best defense is a dedicated anti-ransomware defense. Anti-ransomware solutions on endpoints, mobile devices, email & collaboration solutions, web browsers, and at the network level can identify and block ransomware infections before they can access, encrypt, or breach an organization’s sensitive and valuable data.