Summarized by Molly Luxem, Marketing Assistant
Ransomware is a type of mischievous software cyber actors use to refuse access to systems or data. The mischievous cyber actor holds systems or data hostage until the ransom is paid. After the initial contamination, the ransomware attempts to spread to shared storage drives and other approachable systems. If the requests are not met, the system or encrypted data remains unavailable, or data may be deleted.
An obligation to cyber cleanliness and best practices is critical to defending your networks. Here are some questions you may want to ask of your organization to help avoid ransomware attacks:
How Do I Respond to Ransomware?
Implement your security incident response and business continuity plan. It may take time for your organization’s IT professionals to detach and withdraw the ransomware threat to your systems and restore data and normal operations. In the meantime, you should take steps to maintain your organization’s vital functions according to your business continuity plan. Organizations should maintain and regularly test backup plans, disaster recovery plans, and business continuity procedures.
Contact law enforcement immediately. We encourage you to contact a local FBI or USSS field office immediately to report a ransomware event and request assistance.
There are serious risks to consider before paying the ransom. We do not encourage paying a ransom. We understand that when businesses are faced with an inability to functions, executives will evaluate all options to protect their shareholders, employees, and customers. As you contemplate this choice, consider the following risks:
Ransomware is the fastest growing malware threat, targeting users of all kinds—from the home user to the corporate network. On average, more than 4,000 ransomware intrusions have occurred daily since January 1, 2016. This is a 300-percent increase over the approximately 1,000 attacks per day seen in 2015. There are very powerful prevention and response actions that can considerably alleviate the risk mannered to your organization.
Ransomware targets home users, businesses, and government networks and can lead to temporary or permanent loss of delicate or antidotal information, disruption to traditional operations, financial losses obtained to repair systems and files, and potential harm to an organization’s reputation.
Ransomware may direct a user to click on a link to pay a ransom; however, the link may be malicious and could lead to additional malware epidemics. Some ransomware variants present intimidating messages, such as:
“Your computer was used to visit websites with illegal content. To unlock your computer, you must pay a $100 fine.”
“You only have 96 hours to submit the payment. If you do not send money within provided time, all your files will be permanently encrypted and no one will be able to recover them.”
Protecting Your Networks
Educate Your Personnel
Attackers often enter the organization by tricking a user to disclose a password or click on a virus-laden email attachment.
Advise employees to never click unsolicited links or open unsolicited attachments in emails. To enhance workforce consciousness, the internal security team may test the training of an organization’s workforce with imitated phishing emails.
Proactive Prevention is the Best Defense
Prevention is the most effective defense against ransomware and it is crucial to take precautions for protection. Infections can be disastrous to an individual or organization, and recovery may be a difficult procedure involving the services of a trustworthy data recovery specialist.
The U.S. Government (USG) recommends that users and administrators take the following preventive measures to protect their computer networks from falling victim to a ransomware infection:
Preventive Measures
Enforce an awareness and training program. Because end users are targets, employees and individuals should be aware of the danger of ransomware and how it is delivered.
Facilitate strong spam filters to prevent phishing emails from reaching the end users and validate inbound email using technologies like Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) to prevent email spoofing.
Examine all incoming and outgoing emails to uncover threats and filter executable files from reaching end users.
Configure firewalls to restrict access to known malicious IP addresses.
Patch operating systems, software, and firmware on devices. Consider using a centralized patch management system.
Set anti-virus and anti-malware programs to administer regular scans automatically.
Manage the use of privileged accounts based on the principle of least privilege: no users should be assigned administrative access unless absolutely needed; and those with a need for administrator accounts should only use them when necessary.
Set up access controls—including file, directory, and network share permissions — with least privilege in mind. If a user only needs to read specific files, the user should not have write access to those files, directories, or shares.
Debilitate macro scripts from office files transmitted via email. Consider using Office Viewer software to open Microsoft Office files transferred via email instead of full office suite applications.
Implement Software Restriction Policies (SRP) or other controls to prohibit programs from executing from common ransomware locations, such as temporary folders supporting popular Internet browsers or compression/decompression programs, including the AppData/LocalAppData folder.
Consider disabling Remote Desktop protocol (RDP) if it is not being used.
Use application whitelisting, which only allows systems to execute programs known and permitted by security policy.
Execute operating system environments or specific programs in a virtualized environment.
Classify data based on organizational value and implement physical and reasonable separation of networks and data for different organizational units.
Business Continuity Considerations
Back up data regularly. Establish the integrity of those backups and test the restoration process to ensure it is working.
Conduct an annual penetration test and vulnerability evaluation.
Defend your backups. Confirm backups are not connected permanently to the computers and networks they are backing up. Examples are securing backups in the cloud or physically storing backups offline. Some instances of ransomware have the capability to lock cloud-based backups when systems continuously back up in real time, also known as persistent synchronization. Backups are critical in ransomware recovery and response; if you are infected, a backup may be the best way to recover your critical data.
What to Do If Infected with Ransomware
Should preventive measures fail, the USG advises that organizations consider taking the following steps upon an infection with ransomware:
Disconnect the infected computer immediately. Corrupted systems should be removed from the network as soon as possible to prevent ransomware from attacking network or share drives.
Isolate or power-off affected devices that have not yet been completely corrupted.
This may allow more time to clean and recover data, contain damage, and prevent worsening conditions.
Immediately secure backup data or systems by taking them offline. Ensure backups are free of malware.
Contact law enforcement immediately. We strongly encourage you to contact a local field office of the Federal Bureau of Investigation (FBI) or U.S. Secret Service immediately upon discovery to report a ransomware event and request assistance.
If available, collect and secure partial portions of the ransomed data that might exist.
If possible, change all online account passwords and network passwords after eliminating the system from the network. Furthermore, change all system passwords once the malware is removed from the system.
Delete Registry values and files to stop the program from loading.
Implement your security incident response and business continuity plan. Ideally, organizations will ensure they have proper backups, so their response to an attack will simply be to restore the data from a known clean backup. Having a data backup can eliminate the need to pay a ransom to recover data.
There are severe risks to consider before paying the ransom. USG does not suggest paying a ransom to criminal actors. However, after systems have been negotiated, whether to pay a ransom is a serious decision, requiring the evaluation of all options to protect shareholders, employees, and customers. Victims will want to evaluate the technical feasibility, timeliness, and cost of restarting systems from backup. Ransomware victims may also wish to consider the following aspects:
Paying a ransom does not guarantee an organization will regain access to their data; in fact, some individuals or organizations were never provided with decryption keys after paying a ransom.
Some victims who paid the demand were repeatedly targeted by cyber actors.
After paying the originally demanded ransom, some victims were asked to pay more to get the promised decryption key.
Paying could inadvertently encourage this criminal business model.
How Law Enforcement Can Help
Any entity infected with ransomware should contact law enforcement immediately. Law enforcement may be able to use legal authorities and tools that are unavailable to most organizations. Law enforcement can engage the assistance of international law enforcement partners to pinpoint the stolen or encrypted data or identify the perpetrator. These tools and relationships can greatly increase the odds of successfully capturing the criminal, thereby preventing future losses.
Federal law enforcement places a priority on conducting cyber inspections in a manner that causes minor disruption to a victim entity’s normal procedure and seeks to work accordingly and cautiously with that entity. Federal law enforcement uses investigative measures that avoid unnecessary downtime or displacement of a company’s employees. Federal law enforcement closely coordinates its activities with the affected organization to avoid inexcusable exposure of information.
As an affected entity recovers from a cybersecurity incident, the entity should initiate measures to prevent similar occurrences. Law enforcement agencies and the Department of Homeland Security’s National Cybersecurity and Communications Integration Center can assist organizations in implementing countermeasures and provide information and best practices for avoiding similar incidents in the future. Additionally, the affected organization should administer a post-incident inspection of their response to the incident and determine the strengths and weaknesses of its incident response plan.