If there’s anything organizations should have learnt within the past year, it’s that cyber defenses can, and likely will, fail. Despite having all the necessary safeguards in place, ransomware attacks are bound to occur. Between January - April 2021 alone, eSentire’s Threat Response Unit (TRU) team, composed of expert threat hunters organized to protect you against advanced and emerging threats, along with Dark Web researcher, Mike Mayes, found that ransomware groups have compromised 292 new victims.
While ransomware gangs and their tactical playbooks have certainly evolved to become much more sophisticated, the driving force behind the occurrence of the attacks have also changed. Gone are the days of threat actors targeting organizations to chase a payout - the cyber attacks of today are ideologically motivated, designed and orchestrated to instill chaos within society.
The repercussions of an attack are significantly higher than they were five, ten years ago. While there will always be a financial element tied to these attacks, organizations are undergoing increased scrutiny over maintaining compliance standards for data security & privacy. Should an attack occur, if they are unable to demonstrate they were compliant with these regulations, not only would organizations face significant fines but they also open themselves up to a lawsuit (or two!).
As a result, CISOs don’t have the luxury of assuming they can thwart cyber attacks. While you should be well-equipped to prevent a ransomware attack, we recommend adopting the “assume breach” mentality, wherein you assume that your organization will eventually get breached.
Therefore, it’s critical that security leaders understand how to reduce the impact of a ransomware attack. Here are some of our recommendations:
- Store encrypted backups of your data offline and ensure that your team performs backups on a consistent basis. Moreover, your team should regularly test your backups to see how long data restoration efforts will take and prioritize restoring all critical systems and data first.
Maintain regularly updated “gold images” of critical systems in the event they need to be rebuilt.
Backup copies are not limited to just data. Your team must retain backup hardware to rebuild systems in the event rebuilding the primary system is not preferred.
Implement a company-wide policy that corporate data should not be stored locally on any device. If a device is infected, you can lose all locally-stored data, compared to if the data is stored on the cloud.
Isolate the infected device immediately to limit the spread of ransomware across the rest of the network.
Identify the type of ransomware and/or the threat actors behind the attack, if possible, to determine if there is a possible decryption key already available. If you don’t have the expertise to conduct this investigation in-house, engage an external Incident Response provider that also has Digital Forensics capabilities to lead the charge.
In addition to system images, your team should have the applicable source code or executables backed up (or escrowed, have a license agreement to obtain, etc.) so that if the ransomware infection impacts the application code, you don’t lose it entirely.
Most importantly, create, maintain, and exercise a strong cyber incident response plan and associated communications plan that includes response and notification procedures for a ransomware incident.
Ransomware is one of the biggest threats to any organization today - period. As such, organizations must do everything in their power to reduce the impact of an attack. As long as there is a clear directive and plan in how your team will act in the event of an attack, you may be able to limit the operational disruption or the financial and legal repercussions that could ensue.
To learn how Incident Response can help your organization act fast to reduce the impact of an attack, connect with an eSentire security specialist.
