Thus far, we’ve covered the things you can generally do to protect your data and maintain business continuity in the face of a disaster. But there’s one type of disaster that is on the rise and worth addressing on its own: ransomware.
Cybercriminals have always been a threat, but while the hacktivists of yesteryear were motivated by political, cultural, and religious beliefs, today’s cybercriminals are largely motivated by financial gains. Ransomware, in which a hacker locks you out of your data via encryption until you pay a ransom, is now a multimillion-dollar industry. And in a world where downtime directly translates to lost revenue, it’s never been more tempting to just pay that ransom.
In the following sections, we’ll cover the things you can do to mitigate a ransomware attack.
Preventing a ransomware attack
The best way to fight ransomware is to prevent it from occurring in the first place. It’s about obtaining system-wide visibility, practicing good data hygiene, and having a plan in place to deal with a threat once you’ve identified it.
- Logging and monitoring: Logging and system monitoring tools can give you a bird’s-eye view of your systems and help you understand what your IT infrastructure looks like when everything is running smoothly. Speedy real-time analytics can help you spot anomalies (e.g., a spike in traffic from a suspicious IP address) and other activity that can tip you off to a potential attack.
- Data hygiene: When hackers plant malware, they’re looking for security vulnerabilities such as unpatched operating systems, poorly secured third-party tools, and messy data management. Data hygiene means implementing good patch management, system configuration, and data sanitization practices. Not only do these things make your organization run smoother, but they also greatly reduce the attack surface of a potential hack.
- Operational security: Humans are an often overlooked vulnerability when it comes to cybersecurity. Implementing multi-factor authentication, administrative controls, and data tiering can ensure data is only available to the authorized individuals that need it. Security awareness training covering the techniques of hackers and phishing attacks can help prepare your organization for spotting real attempts in the wild.
What to do during a ransomware attack
Cyber attacks aren’t as obvious in real life as they are to the protagonists of movies. The attack itself may last only 30-40 minutes as they access your files and move laterally through your networks, encrypting files and deleting backups. On the flip side, an attacker might lurk on your network long after gaining access, monitoring your responses to anomalies as they plan out an actual attack. Either way, by the time you receive a ransom note for your data, the attack has already been completed.
The only way to catch a ransomware attack while it’s still happening is to take notice of foiled phishing attempts as they happen (by training your employees) or catch suspicious activity on your network through SEIMs and logs. Provided you’ve taken these proactive steps and have the necessary tooling, it pays to have a cyber incident response (CIR) plan to deal with the anomalous activity when you discover it. Document everything and notify the relevant IT personnel to isolate affected systems and mitigate damage. You’ll need those records to meet compliance requirements and help law enforcement with investigations should that activity prove to be a real ransomware attack. We’ll cover the details of creating a CIR plan later in this article.
Post-ransomware attack disaster recovery
So your files have been encrypted and you’ve just received a ransomware note. What are your options?
One option is to just pay the ransom, but doing so could risk exposing your organization to further extortion down the line.
A better option, provided you followed the proactive ransomware mitigation steps outlined in earlier sections, is to purge, restore, and respond:
- Purge your systems of the vulnerabilities that allowed the attackers to access your data. Compromised hardware and software should be isolated and disconnected from the network immediately. A system and network audit should be conducted to ensure no backdoors or other malware remain. It’s important to sanitize your systems before you restore data from your backups and go live.
- Restore data by leveraging your backup and recovery plan. Hopefully, you have some snapshots and disaster recovery infrastructure in place to allow you to pick things up right before the cyber incident occurred. Your defense team should perform a forensic analysis of your backup data within a sanitized virtual environment to ensure the attackers didn’t leave anything behind. You’re looking for an untampered recovery point you can roll your systems back to.
- Respond to the attack appropriately by taking measures to review records, audit systems, and document the nature of the attack. In order to comply with regulations, you may need to notify customers of a data breach and you’ll want your logs to demonstrate that your organization did everything it could to respond to the attack. Information gained from the attack can be leveraged to help law enforcement track down the perpetrators, as well as help secure your own systems against future attacks.
Learn more: Hacker’s Guide to Ransomware Mitigation and Recovery
