The FBI released statements of warning this week about the rapid growth of ransomware attacks. As attacks become more frequent and sophisticated, it is crucial that businesses are proactive about ransomware prevention. The influx of attacks against hospitals has made ransomware a major threat to the U.S. healthcare industry this year and will only continue without proper protection.
Years prior, ransomware was delivered through email. Now that email systems have evolved, and spam settings have become more sensitive, cyber criminals have stepped away from email delivery. Seeding legitimate websites with malicious code and taking advantage of unpatched software on end-user computers, there is no need for an individual to click on a link in order to be infected. In a usual email attack, a user may see an email addressed to them and open it. Unsuspectingly clicking on the attachment that appears no different than any other attachment, the malware code is then able to access the victims machine and the rest is history.
Once the machine has been infected, the malware begins encrypting the files and folders on local drives, including attached drives, backups and even other computers on a shared network. As seen many times this year, organizations are often unaware of the attack until they are unable to open their files and retrieve data. Sometimes organizations are not made aware of the encryption until messages start to display ransom payment in exchange for a decryption key.
Whether or not to pay the ransom is still under debate. The FBI does not encourage payment, only because paying the bitcoin does not guarantee the safe return of sensitive data. Morally, payment would be frowned upon, as it is most certainly funding illicit criminal activity and encouraging more attacks. However, it is understandable why many have been forced to pay, simply put businesses need their data in order to survive. Unfortunately ransomware criminals know that all too well.
Prevention Measures
- Make sure employees are aware of ransomware and of their critical roles in protecting the organization’s data.
- Patch operating system, software, and firmware on digital devices (which may be made easier through a centralized patch management system).
- Ensure antivirus and anti-malware solutions are set to automatically update and conduct regular scans.
- Manage the use of privileged accounts—no users should be assigned administrative access unless absolutely needed, and only use administrator accounts when necessary.
- Configure access controls, including file, directory, and network share permissions appropriately. If users only need read specific information, they don’t need write-access to those files or directories.
- Implement software restriction policies or other controls to prevent programs from executing from common ransomware locations (e.g., temporary folders supporting popular Internet browsers, compression/decompression programs).
- Back up data regularly.
- Secure your backups. Make sure they aren’t connected to the computers and networks they are backing up.
If you would like to educate yourself in more detail about the information presented in this blog post please visit: FBI: Ransomware threat at all-time high; how to protect company jewels
