On February 27, the United States Marshals Service suffered a ransomware attack. The incident affected systems containing legal process statements, administrative information, and personal identification of the agency that handles, among other functions, federal prisoners in the U.S. At the beginning of the same month, the FBI also suffered an attack that affected the system used for investigations of images of child sexual exploitation. Also in February, La Segunda Seguros, one of Argentina's largest insurance companies, was the victim of a LockBit ransomware attack. This type of threat is having a growing role and these cases show it with name and surname.
Ransomware is a type of cyberattack, one of the most common computer attacks, which blocks access to computer resources -information, systems or networks-, usually to extort money from the affected organization. Occasionally, this resource is used to temporarily interrupt the operation of companies or government agencies such as those mentioned in the previous paragraph, or to affect their public image and credibility.
Typically, it begins with a phishing action in which a user follows a link in an apocryphal email or some security system fails to prevent the action of a virus or other type of intrusion into the system infrastructure of the attacked organization.
|
Since 2019, ransomware vulnerabilities have grown 466%. In addition, 10 of the 13 vulnerabilities exploited in the last six months are critical. |
Other significant findings point out that solutions such as Nessus, Nexus and Qualys, could not pre-emptively identify 18 risks linked to ransomware. This growth in this type of attack significantly affects the global market, as it cuts commercial flows, exchanges of critical information, production processes with a high impact on supply chains and, finally, forces huge resources to be allocated to prevention, safeguarding and disaster recovery strategies that take up a lot of budget, time and human resources.
47.4% of ransomware vulnerabilities affect healthcare systems, 31.6% affect energy systems and 21.1% affect critical industrial sectors.These three attack zones, which are not the only ones, have a lot to do with strategic areas that are involved in cyberwar actions such as the one that today directly involves Russia and Ukraine. Undoubtedly, telecommunications networks and computer systems servers are the battlefronts that add to other traditional scenarios.
The current armed conflict affects many economic sectors and opens the doors to countless transactions through informal channels, in the search to overcome the restrictions derived from the political and military actions involved. All this provides the substrate for an intensification of cyberattacks,which also forces strengthening vulnerability management and cybersecurity strategies even in organizations that are not taking part in the conflict. Then, the consequences of the intersection between war and cyberwar end up transcending the conflict to constitute a new level of risk for organizations in general.
According to Recorded Future's analysis, Russia is experiencing a wave of computer brain drain that is likely to decentralize the organized cybercrime threat landscape, directly impacting information security challenges in the coming years.
You may be interested in reading
How to prepare for a growing threat landscape?
To prevent or reduce the impact of attacks, it is essential to deploy a cybersecurity hygiene strategy that includes:
Read more
Security and resilience in the cloud, from risks to opportunities
When faced with a ransomware attack, there are two paths: negotiate or ‘shut down everything’. The majority consensus, and the recommendation of government agencies, is not to negotiate; however, in the face of desperation, there are those who make payments in cryptocurrencies trusting that they will succeed in restoring access to their information or their systems. Sometimes it happens, but not always.
When there is evidence of an incident, it is necessary to immediately disconnect equipment and networks from the Internet. This can be done by the user, the network administrator or the IT security manager, depending on each case. Depending on the characteristics of the attack, this can reduce the damage surface and mitigate the impact. It is very important that the cybersecurity strategy includes a correctly designed protocol, relayed to all personnel, in which it is clearly stated what must be done and who has each of the required roles.
For both prevention and immediate action after an attack, having the right solutions is one of the fundamental keys to operational continuity and minimising losses.
There are several options to prevent and act against the challenge presented by ransomware as a type of malware. Acronis, for example, has Active Protection, a solution that constantly monitors behavior patterns that affect the files of a given system environment, which is a very powerful tool to identify these types of attacks. This is complemented by the backup capabilities offered by the company (Acronis Cyber Backup) that act after interrupting certain processes once effective incidents are detected.
Good practices that Veeam recommends include implementing an automated disaster recovery plan with V12. Then, the tendency to establish which data should remain unchanged, without any modification, is imposed. Encrypted backups are added, and must be checked regularly; Veeam Recovery Orchestrator is an effective complement that allows for proactive action. It should be noted that good security practices in general establish access limitation to backup copies, multiple authentication factors will be implemented and there will be an architecture that adequately segments the organization's networks. Likewise, the software and security protocols will be kept up to date. Here we also find the concept of permanent monitoring, through the implementation of indicators of compromise (IoCs)), that is, markers that indicate risk scenarios. Finally, fine-tune recovery strategies with the support of Veeam Data Platform.
As for Azure, Microsoft's vision is to incorporate a set of native protections for ransomware into its cloud Microsoft Defender for Cloud provides broad-spectrum threat detection and response capabilities, in a scenario also known as extended detection and response (XDR). Azure Active Directory multi-factor authentication, Azure AD Authenticator app, and Windows Hello are essential in identity and access management policy. In addition, the company has created native DDoS attack mitigations, specific firewall functions, and a Web Application Firewall among many other controls.