• Ransomware 101

    Ransomware

     

    In May 2017, the National Health Service of England and Scotland was hit with the largest ransomware attack at that time. The attack affected an estimated 200,000 computers across 150 countries. The estimated economic loss ranges from hundreds of millions to four billion dollars. This attack, dubbed the WannaCry ransomware attack, catapulted network security to the top of many organization’s priority list.  It brought to light the amount of damage that could be done by a malicious virus.

     

    What is Ransomware?

     

    Ransomware is a type of malicious software, or malware. It is designed to deny access to a computer system or its data until a ransom is paid. It is typically spread through phishing emails or by visiting an infected website. The virus works by encrypting all the data on the user’s hard drive. Then, it requests a payment, usually in the form of cryptocurrency, to be sent to the hackers. However, there is no guarantee the user will recover their files if they pay that ransom.

     

    Ransomware can be devastating for users and organizations. Currently, we are seeing a lot of government agencies, education organizations, and healthcare organizations targeted by these attacks.

     

    What precautions can you take?

     

    In order to protect your user’s and organization’s data, there are a number of precautions you can take. Most of which are best practice even without the threat of ransomware.

     

    First, keep all applications and operating systems up to date. Outdated apps and OS’s are the target of most attacks. This was the case in the WannaCry attack.

     

    Second, train users to avoid phishing emails. These are emails designed to look legitimate at first glance but have links that redirect you to an infected site, or attachments that download the malware directly. Phishing emails and sites are also associated with social engineering attacks designed to steal credentials. It is always a good idea to train users to never click on links or open attachments in unsolicited emails.

     

    Next, backup your data on a regular basis. Backing up your data is a good idea for a myriad of reasons. It can really save you in the case of a ransomware attack. Best practice would be to keep 3 copies of your backups, with one offline and another in a geologically separate location. These backups should also be regularly tested.

     

    A great way to control what is installed on your organization’s computers is access control. Restricting privileges may not allow malware to be installed on a system without an administrator’s approval. This will limit the spread of the malware through a network.

     

    Similarly, another useful tool for fighting malware is a spam filter on your emails. A strong spam filter will prevent most phishing emails from making it to users’ inboxes. It will authenticate inbound emails to prevent spoofing.

     

     

    What to do when you’ve been infected by ransomware

     

    The first thing anyone should do when infected by ransomware is to contact law enforcement immediately. You should report the infection to the FBI’s cyber task forces and internet crime complaint center.

     

    Currently, the FBI does not recommend paying any ransom. While it could cost organizations large sums of money to be down for any length of time, there is no guarantee that paying the ransom will restore your data. There are numerous cases of this happening. Some victims who have paid the ransom have even been targeted again. Other victims have even been asked to pay more after the original ransom to get all their data back. Paying may inadvertently encourage this criminal business model. This makes it more prevalent in the future.

     

    Once you have found out that you are infected, you should isolate any infected machines immediately.  In addition, one should take any unaffected machines offline so they don’t get infected. Same goes for backups. They should be taken offline immediately to stop the ransomware from spreading into your backups.

     

    From there, you should follow your organization’s incident response plan. Follow any instruction given to you by law enforcement.

     

    There will never be any way that you can guarantee you won’t fall victim to one of these attacks. Malware is always evolving, just like security practices are. It will always be an arms race between hackers and security experts. Your best bet is to always follow best security practices, and to always have a plan to recover from any successful attacks.

     

    Where to report Activity

     

    FBI

    Cyber Task Force

    Internet Crime Complaint Center

    United States Secret Service

    Electronic Crimes Task Force

    Local Field Offices

     

    Contact Zunesis to have an assessment done on your current infrastructure.  Ask us about helpful hints to help keep your data secure.

    Categories

  • Archives

  • Social

    • GET IN TOUCH

    EMAIL: info@zunesis.com

         

        

    NAVIGATION

    CORPORATE OFFICE

    Zunesis, Inc.
    12303 Airport Way, Suite 100,
    Broomfield, CO 80021
    (720) 221-5200

    Las Vegas
    6671 Las Vegas Blvd S
    Building D Suite 210, Office 260
    Las Vegas, NV 89119
    (702) 837-5300

    Copyright © 2023 Zunesis. All Rights Reserved. | Website Developed & Managed by C. CREATIVE, LLC