Ransomware Checklist to Minimise Exposure
The simple answer is you can never really be doing enough.
These criminals use sophisticated partnership models to deliver malicious payloads that exploit multiple vulnerabilities. Unfortunately, common control configurations and governance are not being applied in many organisations; attacks are often under-documented and only basic levels of control exist. Because ransomware groups constantly change tactics, security has to evolve with them and ensure that monitoring tools light up malicious events or suspicious activity.
Do not attempt to do this manually; invest in a security services team and a SIEM (Security Incident and Event Management) tool, with a layer of Managed Detection and Response.
What are the common attack vectors?
Only by understanding the methods that cybercriminals use can you mitigate the risks. Three of the most common vectors for ransomware attackers are:
- Social engineering – Phishing
They lure employees to click on a link in spoof emails to obtain user credentials, which can immediately be used to harvest organisational details. - Remote Services – Remote Desktop Protocol
They log into a computer using the Remote Desktop Protocol (RDP) or similar. Actions are then performed under that user identity, or they attempt to elevate privileges. - Exploit Application (Internal/External)
They take advantage of an application bug or vulnerability that has not been patched and will instruct it to perform functions of malicious behaviour.
What steps should you take?
Large cyber security working groups and organisations like the Centre for Internet Security recommend best practice processes and procedures that Ergo aligns with. In the case of ransomware, there are key areas we can assess and augment to give you the best possible cyber security posture.
Backups – You need a backup strategy that addresses your recovery point and recovery time objectives. Backup copies need to be encrypted and protected against ransomware activity. Test regularly and keep an offline copy if possible. With cloud, use immutable/WORM technology and follow the three-tier storage model for your data.
Identity/Access Control – Adopt a zero-trust approach with a least privilege model that assumes everyone and every medium, is a threat. Only grant permissions relevant to roles and use privilege identity management if available. Limit the use of administrative accounts and create passwords with 15 characters or more. Ensure multifactor authentication is made mandatory. Remove any legacy authentication protocols and ensure that all sign-in activity is actively monitored with alerts.
Multi-Factor Authentication – Enforce MFA for all users. This is not an option; it’s essential and should be hardwired into all IT systems.
Security Awareness Training – Align a monthly programme to the NIST Cybersecurity Framework; review and report on it annually. Where possible, do table-top exercises with the business owners of a process.
Mail Domain Security – Use SPF,DKIM and DMARC, these text records help authenticate email senders and recipients; they work together to provide protection against spam, domain spoofing, and phishing.
Removable Media – Block the use of removable media and only sanction by exception. When it is allowed, scan on access and use encrypted removable media.
Server Message Block – The protocol is vital for network file sharing protocol but needs to be blocked across different segments with your firewall/L3 device. Do not allow SMB ports to/from the internet and disable SMBv1.
Virtual Private Network – Multistage or multi layered VPN services are readily available and must be used to secure remote access in and out of the organisation.
Vulnerability and Patch Management – If you haven’t updated your patch management programme recently, do it now and reduce the use of applications to critical functions only. Deploy security patches as soon as possible. Scanning environments for vulnerabilities should be a recurring service, including public IP ranges for open systems on the internet.
Incident Response Management – Create a strategy for incident response and document your playbooks. Use critical contact tree visualisations or the communications plan from your business continuity management documentation.
Logging – Increase the logging ability of your IT systems and ‘ship’ this into a log streaming service using a SIEM or a specialist provider like Ergo. Encrypt your logs where possible; review and familiarise yourself with baseline activity of event data, making it easier to identify anomalies.
Plans and preparation
Planning and preparation are the best form of defence against increasingly sophisticated attacks. Use security frameworks to produce gap analysis and create a programme of work to close out the findings or recognise the risk that the organisation now has to accept, transfer, or mitigate. If in doubt, talk to Ergo. Our security experts can help manage, detect, and respond to your event data and we will quickly build an understanding of your security posture to put you in a better place to remediate a ransomware incident.
To read more about our Managed Detection and Response Services click here or view our Phishing Awareness Poster here.
Alternatively if you have any queries about any of these above issues, please contact our security team at securityteam@ergogroup.ie or your account manager directly.
