Ransomware: Prevention and Using a Zero Loss Strategy

What is ransomware?

Ransomware is a type of malware that ultimately denies a user’s access to files or systems until a sum of money is paid. Ransomware can use your network to spread to all connected devices.

almost half of all data breaches in 2022 begins with stolen credentials. Out of Six hundred malicious email campaigns that were launched in the first half of 2022, 58% of which were phishing emails and 28% contained malware.

Cybercriminals have shifted toward attacking key entry points on networks that rely on cloud services or seek unpatched or software vulnerabilities to launch attacks.

In 2023, Ransomware damages are expected to exceed $30 billion worldwide

@TechCrunch reported in Jan 2023 that Pennsylvania-based nonprofit health provider Maternal & Family Health Services, was hit by ransomware that exposed half a million personal data of current and former patients, employees and vendors. The healthcare giant said it was made aware of the incident on April 4, 2022 but admitted that may have been initially compromised as far back as August 21, 2021.

In November 2022, a major Canadian grocery chain, Sobey’s made headlines after a ransomware attack that cost the company nearly $25mil

There are six types of ransomware:

CryptoWall – is responsible for a high percentage of ransomware attacks. Typically, CryptoWall attacks its target through phishing emails. The WannaCry ransomware virus is a derivative of the Crypto family and was at the core of the largest cyberattacks ever perpetrated. Unfortunately, the creators of CryptoWall continue to release new versions designed to get around security protections.

Locky – as the name implies, is what it does (locks you out of files and replaces the files with the extension .lockey). However, its name misses the most damaging part of this type of ransomware – its speed. Locky has the distinction of spreading to other files throughout the network faster than different ransomware strains.

Crysis – takes data attacks to a new level – actually kidnapping your data and moving it to a new virtual location. The significance of this aspect of the attack is that it qualifies as a breach if your company works with personal data; organizations must contact anyone who may have information on your network to stay in compliance with local, state, and federal guidelines.

Samsan – attacks unpatched WildFly application servers in the internet-facing portion of their network. Once inside the network, the ransomware looks for other systems to attack.

Cerber – attacks the database server processes to gain access instead of going straight after the files. Its creators sell the ransomware software to criminals for a portion of the ransom collected, i.e., Ransomware-as-a-Service.

Maze – is a variant of ransomware representing the trend in what is called “leakware.” After data is encrypted, bad actors threaten to leak ransomed private data on the dark web unless the ransom is paid.

How to detect ransomware?

Devices are often infected with ransomware by clicking on links or downloading attachments placed in unsecure websites, phishing emails, and social media applications. Threat actors often scout your networks for information they can exfiltrate and monitor your communication methods prior to deploying the ransomware.

If your device is infected with ransomware, you will receive a ransom notice on your screen indicating your files have been encrypted and are inaccessible until the ransom is paid.

What happens during a typical attack?

If you do not pay the ransom in the time limit requested, threat action will look like:

threaten to destroy your data permanently,
Release your data publicly.

Payment is often requested in the form of digital currency, like bitcoin, since the transfer would be difficult to trace.

6 steps to prevent a ransomware

Ransomware attacks can cause significant damage, but they are almost completely preventable. Organizations that build a strong cybersecurity foundation will find themselves far less vulnerable to attacks than their competitors with more changes of prevention than looking for a cure.

Follow these six ransomware prevention best practices to bolster your company’s defenses and prevent it from falling victim to this all-too-common attack.

1. Maintain a defense-in-depth security program

Ransomware is a type of malware, and the reality is that most ransomware outbreaks use well-known variants easily detected by active antimalware controls. Some antimalware tools today also offer specialized anti-ransomware features.

Build a defense-in-depth security program that has strong antimalware in conjunction with other technologies and processes, such as the following:

firewalls
endpoint scanning and filtering
network traffic analysis
web filtering
intrusion detection systems
email security filtering
allow listing/deny listing

Ransomware prevention best practices also include following the principle of least privilege; requiring multifactor authentication; using VPNs or other perimeter security technologies for remote employees; disabling or limiting Remote Desktop Protocol use — a common entry point for ransomware attacks — and protecting ports from exploitation.

2. Consider advanced protection technologies

While most ransomware attacks can be caught by basic antimalware defenses, risk remains that attackers will target victims with novel attacks. To detect these zero-days, consider using advanced technologies, including the following:

endpoint detection and response
sandboxing
behavior analysis technologies
zero-trust security and network access
deception technology

3. Educate employees about the risks of social engineering

Ransomware often enters an organization through the inadvertent actions of employees. Most times, this involves an employee falling victim to a phishing attack, clicking a malicious URL, or downloading and opening an infected attachment.

Conduct cybersecurity awareness and training programs for all employees, partners and stakeholders. Offer current and consistent messaging on a regular basis.

Advise employees to do the following:

Use strong passwords.
Verify email senders.
Only open links and attachments from known senders.
Do not click questionable links or download suspicious attachments.

Unprepared employees can expose a company to significant risk. Ensure the staff knows what to do in the event ransomware does infect the network and notify management immediately.

Develop a ransomware incident response plan that includes actions for employees, the security team, management, etc.

4. Patch regularly

Regularly installing patches for software and system vulnerabilities could have saved many organizations a lot of time, stress and money. The notorious WannaCry ransomware attack in May 2017, for example, exploited a vulnerability in legacy versions of the Server Message Block protocol. Microsoft released a patch for the vulnerability in March 2017, but the WannaCry ransomware still affected approximately 230,000 systems worldwide.

Follow a patch management program and best practices to ensure any vulnerabilities are patched quickly and efficiently.

5. Perform frequent backups of critical data

Most ransomware attacks aim to deprive victims of access to critical information until they pay a ransom. Backups can mitigate this risk by providing you with a fallback plan.

If ransomware encrypts your data, backups can help restore access quickly without meeting the attacker’s demands. Store backups where they cannot be accessed from the network. Disconnect the backup, or put it on an external device so it will not be affected by a ransomware attack.

Remember: Restoring from backup brings you to a point in time where you likely still have the same vulnerability that attackers originally exploited. Make sure your ransomware recovery process includes the identification and remediation of the incident’s root cause.

6. Don’t depend solely on backups

Ransomware is evolving. Many attackers now employ double extortion — they encrypt the victim’s data and exfiltrate it. This way, even if a company restores its data from backup, the attacker can still demand a ransom be paid to not leak the data.

Backups are important, but they’re only one element of a defense-in-depth ransomware prevention strategy.

How can I prepare my organization?

Data protection and ransomware prevention are technical problems that come under the purview of the IT team

There are several ways you can minimize your risk and prepare your organization if a ransomware attack occurs.

Plan ahead. Develop an incident response plan to address how your organization will monitor, detect and respond to an incident, such as a ransomware attack. Your plan should also include a backup, recovery, and communication plan. Your incident response plan should designate roles for your employees and provide them with detailed instructions in the event of an incident.

Provide security awareness training for employees. Provide employees with tailored cyber security and device management training to ensure they don’t fall victim to malicious activities such as phishing emails and infected downloads.

Practice recovering. Test your incident response and recovery plan by conducting simulations or walk-through exercises. The scenario should test the effectiveness of your response and highlight areas requiring improvement.

Consider cyber insurance. Research cyber insurance providers and policy details to determine whether it would benefit for your organization.

Best ransomware protection

Data loss from ransomware attacks has the potential to disrupt business operations and has caused some firms to go out of business. In the event of a successful attack, businesses should be able to recover quickly and go back to business as usual.

With more capable technology and new features, businesses can move past a ransomware attack with reduced risk to their data and with faster resumption of normal operations

This “time to resuming operations” is the real measure of how valuable a ransomware-protection solution is.

What is zero loss strategy as a business-critical approach to fighting ransomware

A zero-loss strategy provides a comprehensive solution and is implemented using a multilayered security framework, helping to mitigate the impact of ransomware and ensure data integrity. It also minimizes operational complexity and brings certainty to recovery.

Businesses must constantly improve defenses as attackers innovate and change their tactics. Zero loss is a framework that does just that. Defenders need a framework that is agile and can respond to new threat types, a strength of zero trust.

How is this done

Zero loss uses a comprehensive approach with several layers of capabilities that all work together to provide more protection than individual solutions and that are focused on only one aspect of the problem.

The concept is designed to protect against the entire ransomware lifecycle.

Benefits of a zero loss strategy

Zero loss provides better protection and lowers the impact of any successful attack, minimizing the impact on the business. Recovery is the single most important objective. A modern zero-loss solution will reduce the time necessary to recover and ensure that the data used for recovery is not corrupt. Improving defenses is mandatory.

continuously plan, identify, and monitor data across any workload, with a faster response time and flexible restore options.
combines attack identification and remediation while ensuring data protection.
uses a comprehensive approach with several layers of capabilities that all work together to provide more protection than individual solutions and that are focused on only one aspect of the problem.
The concept is designed to protect against the entire ransomware lifecycle.
simplifies and speed up recovery in the event of any successful incursion.
have coverage for all workloads and to eliminate gaps in data protection and monitoring.
Visibility must work across SaaS, cloud-native, and on-premises infrastructure with consistent management tools and reporting to enable the IT or SecOps team to respond at speed.
Ability to support cloud integration. A scalable, single management console provides ops teams with one complete and comprehensive source to simplify their work and speed response.
Ability to protect more data and workloads (cloud, SaaS, etc.) across the infrastructure, gives the business the agility to use the most appropriate infrastructure for the workload.
improves integration and collaboration among the different groups that are involved in protecting corporate data.
With a zero-loss approach, a common set of metrics and operating approaches serves as the foundation for effective teamwork among all the groups involved in data protection and security.
Eliminates gaps in reporting and visibility that may give an attacker a head start.

The Characteristics of a Modern Zero-loss Strategy for Data Protection

Zero loss demands an underlying technology platform that has the comprehensive functionality necessary to support it. The foundation for zero loss is visibility of all the data that needs protection across the IT estate. Simply rebranding legacy data protection solutions does not solve the problem or deliver the key benefits.

It integrates data protection/monitoring solutions with other security tools to provide a layered defense and reduce vulnerabilities.
It coordinates and integrates disparate tools/solutions for security to provide defense in depth and leverage capabilities found in different options.
Combines modern management and protection capabilities, with a focus on management functionality.
Comprehensive visibility lets SecOps/IT teams identify any malicious or potentially malicious activities in both production data and backups.
Delivers key information from reporting/management tools that quickly identify and alert to any potential incursions or issues.
To ensure protection, constant monitoring of data—both live and backups—is required to ensure any ransomware infection doesn’t get a head start.

Enabling ZeroLoss

To enable the zero-loss strategy, the solution must leverage the zero trust security framework to increase protection and defense. This includes continual credentials verification even inside the firewall to stop lateral spread and cross-workload corruption.

Use of a single console to manage the entire process, using the intelligence of when the attack occurred, ensuring only a clean backup is used.
The recovery process is highly automated to reduce the time needed to get up and running. The automated tools also delete any files that are suspected of being infected.
on-call services that both ensure a successful ransomware protection and design plan and offer support during an event if the technical teams need additional bandwidth or expertise.

Determine how prepared your organization is for a ransomware attack. Take the Commvault risk assessment to find out: https://www.commvault.com/ransomware/risk-assessment.

Conclusion

Open Storage Solutions® is your all-in-one security partner. With multiple decades of experience and proven expertise, OSS offers a multi-layered security service that delivers a hardened approach to data protection and compliance to comprehensively safeguard your SaaS applications and helps detect malicious actors faster, with zero loss strategy.