The FBI recently noted a decline in ransomware attacks reported to the agency in 2017, at 1,783 compared to 2,673 the previous year. But don’t necessarily read this as good news. The reality is ransomware, like many other cyber-attack types, goes largely under-reported. A Verizon report, based on its analysis of tens of thousands of real-world security incidents, found that ransomware incidents have doubled over the past year.
Ransomware is a class of malware that locks your system and encrypts vital files. Attackers usually demand a cryptocurrency payment to release the files, but there’s no guarantee they will actually do so after receiving payment.
Attackers have typically cast the net wide, but criminals are becoming more sophisticated about how they can maximize profit.
“We used to hear very often it was mostly consumers – but [for those attacks] you’re looking at $75 as a cyber-criminal,” says Theresa Payton, former Whitehouse CIO who’s now president and CEO of Fortalice Solutions. “Why do that when you can go from a mom and pop shop all the way up to the Fortune 50?
“And that’s what they’re doing. They’re hitting all businesses, targeting Any business connected to the internet – and what business isn’t?”
Significant Impact
In 2017 the WannaCry, NotPetya, and BadRabbit strains didn’t just disrupt business processes; they hobbled infrastructure and hurt international brands like FedEx. This took the ransomware threat vector to a “completely new level,” using worms to propagate through systems and impacting 300-400,000 devices worldwide, says Steven Wilson, head of Europol’s EC3 cyber-crime center.
And the rise of off-the-shelf kits that can be bought online for just dollars puts ransomware tools in the hands of anyone with the will to use them.
The organizational impact can be severe, ranging from downtime to reputational damage. One official British report suggested that the public response to WannaCry had even undermined trust in government.
“Just think: your entire customer records database is gone,” says Wilson. “You don’t know who owes you money, who you owe money to, or who you’re going to sell your product to. That’s the reality if ransomware strikes you. Everything is gone.”
Raising Awareness
If there is a positive outcome, it’s that WannaCry raised awareness that ransomware is here to stay: an unfortunate case of “if” and not “when”.Fortunately, there are basic cyber hygiene steps you can introduce to avert potential disaster.
Often it’s the unpredictable human element that’s the weakest link in cyber defense, so awareness training can go a long way.
On the technical side, it’s making sure your systems are up to date and fully patched so that the latest versions of your operating systems are running with trusted anti-malware solutions and the latest definitions.
And if the worst happens, maintain a recovery plan with a full set of backups.
According to Payton, organizations should also consider network segmentation and be introducing kill switches to prevent malware from moving laterally, as WannaCry did.
“Practice for the worst and hope for the best – making sure you’re thinking ahead, practicing that digital disaster, practicing your comms plan,” suggests Payton, adding that organizations should also perform test runs on full restores.
How can the technology community help?
Public and private bodies must work together with vulnerabilities out in the open, collaborating to prevent or mitigate future disasters. NoMoreRansom, for example, pools resources across organizations to provide decryptors for known threats.
Source: CIO