Ransomware Threats - How secure are you?

In 2020, it seems like there is a new headline just about every week of another major company getting hit with a ransomware attack.  Per the New York Times, “A woman died from treatment delays after a hospital in Germany hit by a cyberattack was forced to turn away emergency patients. Hackers released private information, including Social Security numbers, from a Las Vegas school district. A coronavirus vaccine trial was bogged down in recent weeks when researchers were locked out of their data.”  Adding to this you see major companies like Garmin getting their core infrastructure hit and having to pay a 10-million-dollar ransom to get access to their data back.

How did this problem get so bad?  In essence, cyber criminals found that the payout is higher and easier with ransomware that other types of cybercrime.  Once other cyber criminal organizations noticed and caught on, the race was on.  To compound matters even further, companies have started increasingly purchasing cybersecurity liability insurance against ransomware attacks.  This is a double edged because if a company has liability insurance, then they will likely pay the ransom making them more enticing of a target.

So, what exactly is ransomware?  Essentially ransomware involves an attacker typically performing a phishing attack against an unsuspecting employee of said corporation.  If the phish is successful and the attacker has access to the inside network, they will scour the network looking for valuable information such as confidential customer files, database, and other essential intellectual property to the organization.  Once they have the information, they will encrypt the information or systems with the attacker’s private key so that information or systems are inaccessible without the attacker’s private key to decrypt the information.  The attacker will contact by various communication channel means the target and ask for payment (i.e., “the ransom”) for the private key for the organization to get access to their files.

A common question asked is should the company pay the ransom?  The answer is it depends.  Companies should consider the pros and cons of paying and what essentially is inaccessible.  If a company’s strategic or critical assets such as customer data used for company business or the nature of your business is time sensitive, (i.e., a hospital) than companies might want to consider paying.  If company assets that are hit have full backups and are not critical to essential operations, they might want to consider not paying and performing recovery operations immediately as part of their incident response/contingency plans.  Another factor that companies should be aware of is whom the intended ransomware payment is going to.  Recent policy guidance was issued by the Treasure Department stating that companies must ensure ransomware payment are not directed towards entities that were terrorist countries or organizations,  Per the NLR, “Under the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA), among other laws, executive orders, and regulations, U.S. persons generally are prohibited from engaging in transactions — directly or indirectly — with individuals or entities “designated” on OFAC’s Specially Designated Nationals and Blocked Persons List (SDN List), as well as persons or entities covered by comprehensive country embargoes (e.g., Cuba, Iran, North Korea, Syria, and the Crimea region of Ukraine).”  This should be carefully discussed and determined with company legal and law enforcement prior to authorizing payment as there could criminal liabilities if found actions were to occur.

So, what can a company do to prevent or at least minimize the threat of ransomware?  While there is no magic panacea to prevent ransomware, a company should take the following steps.  Companies should remain vigilant and maintain software patches to minimize vulnerabilities attackers might exploit to plan ransomware.  Companies should ensure network boundary devices are hardened and minimize unnecessary ports or services access to their infrastructure.  Companies should remain vigilant and ensure frequent user security awareness training to be aware of the latest threat vectors to prevent phishing attacks. 

Worried about Ransomware?  Need some guidance on getting your network and company assets better organized?  Talk to us!  Our consultants are Grove can help you understand the risks of ransomware and design a solution specifically for your organization to minimize these and other cybersecurity threats.