Attacks/Breaches

4/9/2018
12:45 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Increasingly Aggressive Malware Drives IT Pros to Re-Examine Backup Strategies, Solutions

TORONTO – April 4, 2018 – Asigra Inc., a leading cloud backup, recovery and restore software provider since 1986, today highlighted the 2018 Breach Briefing(1), a new report by Beazley Breach Response (BBR) Services which found that the threat from ransomware is far from over. In defense of business continuity across all impacted industries, Asigra is calling for organizations to review their backup policies and double down on redundancy so that multiple remote copies of mission critical backups are available when the next attack occurs.

According to BBR Services, “Ransomware remained a constant threat in 2017, including two notable worldwide attacks. BBR Services saw an 18% increase in ransomware incidents in 2017, and ransomware attacks are still occurring across industries and market segments. And while BBR Services received more notifications of ransomware attacks from smaller companies, notifications from larger companies in the middle market still accounted for 42% of the 2017 ransomware attacks.”(2)

Data protection specialists agree that the number one strategy for recovering data lost to criminal encryption is through a reliable data recovery strategy. However, with strands of ransomware now targeting backup data, organizations must take extra steps to ensure their backup data is clean before conducting a recovery. Regardless of the backup platform used, a redundant data protection strategy should be employed to ensure an effective recovery. This approach requires that multiple copies of the company’s mission critical data are created. These backup sets should be stored on multiple media formats, such as secondary disk storage or the cloud with at least one of the backup data sets stored in an offsite location. Once in place, data policies should also be enhanced to include more regular test recoveries to determine the effectiveness, quality and speed of the recovery.

To avoid Ransomware or other malware variants entering your network(s) in the first place, the report  revealed a number of actions that organizations should take immediately to protect their IT systems against attacks, including:

•       Training employees on the indicators of ransomware and malware, how to identify phishing emails, and how to report suspected incidents;
•       Keeping systems up to date and patch as soon as possible;
•       Enabling automated patching for operating systems and browsers;
•       Segregating networks based on functionality and the need to access resources, including physical or virtual separation of sensitive information;
•       Limiting unnecessary lateral communications within the network;
•       Managing the use of privileged accounts. Implementing the principle of “least privilege.” No users should be assigned administrative access unless absolutely needed. Those with a need should only use them when necessary. Additionally, organizations should limit the use of administrative shares;
•       Configuring access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access;
•       Hardening network devices with secure configurations, including disabling unnecessary services and remote administration protocols. Always change default passwords;
•       Taking advantage of threat intelligence resources including alerts from US-CERT and information provided by regulators for your industry, such as the Health and Human Services (HHS) Office of Civil Rights Privacy and Security listserv, and 
•       Requiring two-factor authentication for external access to all applications. 

As organizations called on their backup sets to recover data that was encrypted by ransomware, the entities behind such attacks have made headway in seeking out and infecting backup data. This has resulted in a recovery attack-loop that re-introduces time-delayed, undetected ransomware onto the network from the backup data. This has negatively impacted recovery for many organizations as it renders the recovery of encrypted files useless, allowing the malware to re-constitute and re-encrypt the primary data again. Therefore, defending recovery data from such attacks using a redundant backup strategy is key as is the deployment of an evolved data protection solution that offers a robust recovery framework.

“Backup and recovery has become recognized as the last line of defense in the continued operation of a business after a crippling malware attack occurs,” said Eran Farajun, Executive Vice President, Asigra. “By taking the necessary steps to tighten security and conducting a review of one’s backup strategy and policies, recovery readiness can be assured for the next round of attacks.”

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-10727
PUBLISHED: 2018-07-20
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive ...
CVE-2018-8018
PUBLISHED: 2018-07-20
Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a spe...
CVE-2018-14415
PUBLISHED: 2018-07-20
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.
CVE-2018-14418
PUBLISHED: 2018-07-20
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.
CVE-2018-14419
PUBLISHED: 2018-07-20
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.