It is not just a scare tactic, and it is not going away
Ransomware activity continues to rise, and it doesn’t appear to be slowing down for 2017. In 2016 it spiked by 6000%, and it is on track to be a 1 billion dollar a year “business.” IBM study.
Software teams are building ransomware kits to sell on the Dark Web. RaaS (Ransomware as a service!) is a thing. This means there are illegal companies making money from designing kits to build ransomware. So, not only are criminals making money from ransomware, the distributors don’t even have to be good at programming or hacking to do it. There is enough of a demand that a small team of programmers is making money from selling the software to commit the crime. It is also making it extremely hard for old fashion virus scanners to catch the activity because each criminal is adding their own twist.
How it happens
- Phishing email
- user clicks on link or attachment
- ransomware makes contact
- C&C server generates & retrieves an encryption key
- ransomware scans infected a machine, looking for files
- ransom demand
- connects to other machines and infects them
- ransomware builds an inventory of encrypted files
- scan other machines over the network
It used to be consumers or simplistic shotgunning techniques. Now there is more and more direct targeting. Business targets make sense to the bad guys. Consumers or individuals might just start from scratch, but businesses are more likely to pay a ransom. It is much more lucrative form them to target small business.
Spearphishing is direct targeting your personal account using techniques to fool you into trusting the source. The criminal could use social media sites to gather information. The email may be crafted specifically for you and may even look like it comes from a person you know. One click is all it takes. And it isn’t just email anymore. Messaging, texting, and other apps can lead to infection.
What do you do about it?
Backup! Backup! Backup!
Step number one should be making sure your backup is up to date and ready to be restored. One “newer” option is DRaaS (disaster recovery as a service) but even a simple disk backup is better than nothing. Regardless, you need to spend time analyzing your current setup and determining if you need to take further steps to protect your data. If you have multiple, granular, safe and secure backups and can restore your data, you don’t have to pay the ransom.
Keep your devices and systems on the latest version and patches. This should include firmware. Less exploitable software and devices mean that if you do get infected, it is less likely to spread.
Yes, you still need endpoint protection. While signature based isn’t what it used to be, companies are making strides and it is still worthwhile. You should look for something with anti-malware, anti-ransomware, and anti-exploit features. And you should protect all your devices: Mobile, desktops, laptops, physical and virtual servers.
This should include some type of email protection even if you are using an outside source (Gmail, Office 365, Hosted solution) to host your email. You should also have a firewall with a strong IPS/IDS (intrusion protection system/intrusion detection system). Use VPNs whenever possible. This includes cloud and virtual. Do not make the mistake of assuming that these technologies make your network safer.
Also, please do not use a consumer class gateway/firewall. And if you insist on using one, change the default password!
Establish a Security Policy
This one may sound simple but it is possibly the most important and hardest to implement. You need to train your users. You need to train yourself. You need to have plans in place in case something does happen.