A startling number of security professionals, when asked about ransomware readiness, admit that they do not feel confident they have the right tools, processes, or people in place. In fact, many organizations struggle to identify and implement the right solutions for ransomware prevention in the first place. The main reason for the disconnect tends to revolve around a few key misconceptions about ransomware. Take for instance, the thought that endpoint protection is all an organization needs. If you look at the headlines, plenty of organizations had solid endpoint detection and response capabilities and still became victims of ransomware. With that said, what does an organization need for a successful ransomware readiness approach?
Tactics for a Successful Ransomware Readiness Approach
A solid endpoint detection and response platform is key to overall ransomware protection. Pattern and behavior-based approaches, balanced with signature-based protection, is a compelling blend for overall ransomware prevention. Many consider ransomware reaching the endpoint as “too late” but it is better to have the capability then not.
Consider DNS protection as another layer of overall ransomware prevention. The malware is blocked from being downloaded if it is a known malicious website.
Many ransomware attacks begin with an email that either contains attached malware or a link to a location to download the malware. An email security solution scans for malicious attachments and strips them as well as protecting from clicking on malicious links.
Malware that is detonated in a sandbox is unable to impact an endpoint. Secure browsing solutions isolate browsing sessions in a container or sandbox and only replays input, output, and video to the end user, preventing ransomware from ever reaching an endpoint.
When all else fails, keeping ransomware contained on a single endpoint is the goal. Ransomware is insidious and attempts to spread to as many systems and file shares as possible. Lateral movement prevention keeps malware from moving across the network to additional systems.
Imagine an environment where people and systems only had enough access to perform a given task at a given time. This utopian compute approach is no longer science fiction, and many organizations are implementing just in time access control to prevent the spread of ransomware.
Who has access to what information? This question is key to preventing the spread of ransomware since if a limited number of users have write access to unstructured data, the malware essentially starves before it can do any real damage.
In the unlikely event that ransomware impacts an organization after implementing the steps above, a sound secure backup strategy is essential for ransomware recovery. Backups should be secure, scanned, and contain an offline copy that is free from ransomware that targets backups.
Often called the “Ransomware Response Playbook,” organizations need an incident response plan specific to a ransomware attack. The response plan should be kept “offline” to avoid having the file encrypted by the ransomware. It is suggested that as part of a ransomware readiness program, an organization keep a bitcoin bank at the ready in case a ransom needs to be paid.
How does an organization continue in the event of a ransomware infection? Having a well laid out recovery plan with local and federal law enforcement contacts is important to know what needs to be done to continue business.”
Ransomware readiness is achievable for any organization. Keep in mind, following the best practices outlined above will reduce the likelihood of breach, but with all things in cybersecurity, nothing is one hundred percent preventable. With the statistic stating that a compromise caused by ransomware is still possible, the most often asked question is “how do we return to normal?” The best way to return to normal is to make sure that any impacted systems or data are held for forensic analysis. A root cause analysis should be performed, and defenses need to be improved based on the findings. Once defenses are improved, data can be restored from a verified safe backup, and business can resume as normal.
