Defending against ransomware: strategies for resilience

In the ever-evolving landscape of cyber security, few threats are as menacing and pervasive as ransomware. Ransomware attacks have surged in recent years, causing significant financial losses, data breaches, and operational disruptions for organisations of all sizes. To safeguard your organisation against ransomware attacks, it’s crucial to adopt a multi-faceted approach that combines proactive measures, robust defences and effective incident response strategies.

In this blog, Has Gateru, Senior Governance, Risk and Compliance (GRC) Consultant, explores the key strategies for defending against ransomware and the impact of an attack.

What is ransomware – and what are the consequences?

Ransomware is a form of malicious software that encrypts a victim’s files, rendering them inaccessible. The attacker then demands a ransom, usually in cryptocurrency, in exchange for a decryption key that can unlock the files. Ransomware attacks can have devastating consequences for organisations, some of which are listed below.  

Financial loss: Paying the ransom is a costly endeavour, and there are no guarantees that the attacker will provide the decryption key. Even if the ransom is paid, the attacker may return for more.

Data loss: If an organisation refuses to pay the ransom, data can be lost permanently, impacting critical operations, intellectual property and customer information.

Reputational damage: Ransomware attacks can erode an organisation’s reputation, eroding trust among customers, partners and stakeholders.

Operational disruption: Ransomware can halt business operations, causing significant downtime and financial loss.

Legal and compliance issues: Data breaches resulting from ransomware attacks can lead to legal and compliance problems, potentially resulting in fines and legal action.

Ransomware entry points and techniques

There are many different ways in which ransomware can find its way onto systems, coupled with coercion and extortion techniques that contribute to its high profitability.

Phishing/social engineering: Attackers use deceptive emails, messages or websites to trick users into clicking on malicious links or downloading infected attachments. Social engineering techniques manipulate individuals into revealing sensitive information or executing actions that facilitate ransomware installation.

Web drive by/malicious ads: Cyber criminals compromise legitimate websites or display malicious ads that, when clicked, initiate the download and execution of ransomware. Drive-by attacks exploit vulnerabilities in browsers or plugins, allowing ransomware to be delivered without any user interaction beyond visiting a compromised site.

Trojanised business or OpenSource software: Attackers infiltrate legitimate software packages with ransomware, exploiting the trust users place in well-known applications. Trojanised software, often distributed through unofficial channels, can lead to the inadvertent installation of ransomware on systems.

Infrastructure vulnerabilities (zero days): Zero-day vulnerabilities target undiscovered or unpatched flaws in software, providing attackers with the opportunity to exploit systems before security updates are available. Ransomware groups may use sophisticated methods to identify and exploit these vulnerabilities to gain unauthorised access to systems.

Ransomware extortion techniques

In addition to these entry points, ransomware groups employ coercion techniques and extortion strategies to maximise their profits. Take a look at some of these below.

Coercion techniques: Threats and intimidation are used to coerce individuals into paying ransoms. Tactics such as fear-inducing messages or claiming to have compromising information on the victim may pressure them to comply.

Extortion: Ransomware attackers demand payment in exchange for restoring access to encrypted data. Payment is typically requested in cryptocurrencies, enhancing the anonymity of the attackers.

Double extortion: In addition to encrypting files, attackers threaten to release sensitive data publicly unless the ransom is paid. This tactic increases the pressure on victims to comply, as the potential for data exposure becomes an additional concern.

Triple extortion: Extending the threat further, attackers may involve regulatory bodies or threaten to report victims for non-compliance with data protection laws. This additional layer of pressure compromises the victim’s supply chain, targeting business partners, vendors, or clients to increase leverage.

Quadruple extortion: This tactic expands the pool of potential victims and reinforces the interconnected nature of modern business ecosystems. It aims to force organisations into paying the ransom to avoid legal consequences.

The combination of sophisticated entry points, coercion techniques, and extortion strategies makes ransomware a highly lucrative and pervasive threat. Organisations must adopt a comprehensive approach, incorporating robust cyber security practices, employee education and the timely application of security updates to mitigate the risk of ransomware attacks. 

Strategies for ransomware resilience

Building resilience against ransomware requires a comprehensive and proactive approach. Take a look at the strategies essential to protecting your organisation below.

Backup and recovery

Regularly back up critical data and systems. Ensure backups are isolated from the production network and regularly tested for reliability.

Implement versioning in backups to allow the restoration of unencrypted files from different points in time.

Create a detailed recovery plan that includes steps for data restoration and system recovery.

Patch management

Keep software, operating systems, and applications up to date with the latest security patches. Many ransomware attacks exploit known vulnerabilities that could have been patched.

Prioritise vulnerabilities that are actively being exploited in the wild by threats as part of your overall approach to vulnerability management.

User training and awareness

Frequently educate employees about the risks of phishing emails and other social engineering tactics that ransomware attackers often use.

Encourage users to exercise caution when clicking on links or downloading email attachments.

Email security

Implement robust email security solutions that can detect and quarantine phishing emails and malicious attachments.

Use advanced email filtering to reduce the chances of users encountering malicious links or attachments.

Ensure you have appropriate incident runbooks in place in the event sophisticated phishing emails do get through and are acted on by end users.

Network segmentation

Segment your network to limit lateral movement for attackers in case of a breach. Isolating critical systems can prevent the spread of ransomware.

Where possible, adopt a zero-trust approach to network security, not trusting any network location or segment by design until verified on each interaction.

Endpoint security

Deploy advanced endpoint security solutions that can detect and block ransomware before it can execute on endpoints.

Regularly update and configure endpoint security software to maximise its effectiveness.

Ensure you have appropriate incident runbooks in place where novel or sophisticated ransomware techniques were able to bypass automated block capabilities in endpoint security solutions.

Replace anti-malware/virus solutions with advanced endpoint detection and response technologies to address the advanced techniques used by threats.

Access control

Limit user privileges and access to only what is necessary to perform their job.

Implement the principle of least privilege to minimise the attack surface.

Review privileges regularly to ensure they remain minimised over time.

Incident response plan

Develop a well-defined incident response plan that includes ransomware-specific procedures.

Ensure all relevant stakeholders understand their roles and responsibilities during a ransomware incident.

Cryptocurrency policies

Create a clear policy regarding the payment of ransoms. Avoid paying ransoms whenever possible, as there is no guarantee of receiving a decryption key.

Threat intelligence

Stay informed about the latest ransomware threats and attack techniques through threat intelligence feeds.

Use this information to fine-tune your defences and incident response procedures.

Security audits and penetration testing

Regularly audit your security posture and conduct penetration testing to identify vulnerabilities that could be exploited by ransomware.

Data encryption

Encrypt sensitive data both at rest and in transit. This adds an additional layer of protection in case of a breach.

Collaboration with law enforcement

Establish relationships with law enforcement agencies to report ransomware incidents and potentially receive assistance in tracking and apprehending attackers.

Regular tabletop exercises

Conduct ransomware-specific tabletop exercises to simulate real-world scenarios and test the effectiveness of your incident response plan.

Cyber insurance

In the worst-case scenario, ransomware attacks can be devastating financially. Cyber insurance can help cover some of the costs providing you meet the requirements of the underwriter. Insurers can also help connect you to appropriate expertise to help with other types of fallout such as public relations firms.

The power of prevention

While strong defences are essential, prevention remains the most potent tool in the fight against ransomware. Defences encompass measures to protect and respond to threats, including security controls and strategies aimed at mitigating risks post-incident. In contrast, preventions concentrate on stopping or blocking threats before they occur by eliminating vulnerabilities and proactively thwarting potential attacks before they materialise.

By focusing on the strategies mentioned above, you can significantly reduce the likelihood of a successful attack. However, it’s also crucial to prepare for the worst-case scenario, acknowledging that despite your best efforts, an attack might occur.

What to do when a ransomware attack occurs

In the unfortunate event that ransomware attack occurs in your organisation, it’s essential to respond swiftly and effectively.

Isolate affected systems: As soon as the attack is detected, isolate affected systems to prevent further spread.

Notify relevant stakeholders: Alert your incident response team, executive leadership, and legal counsel.

Assess the extent of damage: Determine the extent of the damage and whether data has been exfiltrated.

Contact law enforcement: If required, contact law enforcement to report the incident and seek their guidance.

Invoke your incident response plan: Follow your well-defined incident response plan to contain the attack, recover data, and restore operations.

Communicate transparently: Keep stakeholders, including employees and customers, informed about the situation and the steps being taken to resolve it.

Avoid ransom payment: It’s generally not recommended to pay the ransom, as there are no guarantees of receiving the decryption key, and it may incentivise further attacks.

Forensic analysis: After the incident is resolved, conduct a forensic analysis to understand how the attack occurred and prevent future occurrences.

Ransomware is a persistent and formidable threat that requires a proactive and multi-layered approach to defend against effectively. Building resilience against ransomware involves a combination of prevention, robust defences, and a well-prepared incident response plan. By implementing these strategies and cultivating a security-aware culture within your organisation, you can significantly reduce the risk of falling victim to a ransomware attack and minimise the potential damage should an attack occur. Stay vigilant, stay prepared, and protect your organisation from the menace of ransomware.