Attacks/Breaches

4/9/2018
12:45 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Increasingly Aggressive Malware Drives IT Pros to Re-Examine Backup Strategies, Solutions

TORONTO – April 4, 2018 – Asigra Inc., a leading cloud backup, recovery and restore software provider since 1986, today highlighted the 2018 Breach Briefing(1), a new report by Beazley Breach Response (BBR) Services which found that the threat from ransomware is far from over. In defense of business continuity across all impacted industries, Asigra is calling for organizations to review their backup policies and double down on redundancy so that multiple remote copies of mission critical backups are available when the next attack occurs.

According to BBR Services, “Ransomware remained a constant threat in 2017, including two notable worldwide attacks. BBR Services saw an 18% increase in ransomware incidents in 2017, and ransomware attacks are still occurring across industries and market segments. And while BBR Services received more notifications of ransomware attacks from smaller companies, notifications from larger companies in the middle market still accounted for 42% of the 2017 ransomware attacks.”(2)

Data protection specialists agree that the number one strategy for recovering data lost to criminal encryption is through a reliable data recovery strategy. However, with strands of ransomware now targeting backup data, organizations must take extra steps to ensure their backup data is clean before conducting a recovery. Regardless of the backup platform used, a redundant data protection strategy should be employed to ensure an effective recovery. This approach requires that multiple copies of the company’s mission critical data are created. These backup sets should be stored on multiple media formats, such as secondary disk storage or the cloud with at least one of the backup data sets stored in an offsite location. Once in place, data policies should also be enhanced to include more regular test recoveries to determine the effectiveness, quality and speed of the recovery.

To avoid Ransomware or other malware variants entering your network(s) in the first place, the report  revealed a number of actions that organizations should take immediately to protect their IT systems against attacks, including:

•       Training employees on the indicators of ransomware and malware, how to identify phishing emails, and how to report suspected incidents;
•       Keeping systems up to date and patch as soon as possible;
•       Enabling automated patching for operating systems and browsers;
•       Segregating networks based on functionality and the need to access resources, including physical or virtual separation of sensitive information;
•       Limiting unnecessary lateral communications within the network;
•       Managing the use of privileged accounts. Implementing the principle of “least privilege.” No users should be assigned administrative access unless absolutely needed. Those with a need should only use them when necessary. Additionally, organizations should limit the use of administrative shares;
•       Configuring access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access;
•       Hardening network devices with secure configurations, including disabling unnecessary services and remote administration protocols. Always change default passwords;
•       Taking advantage of threat intelligence resources including alerts from US-CERT and information provided by regulators for your industry, such as the Health and Human Services (HHS) Office of Civil Rights Privacy and Security listserv, and 
•       Requiring two-factor authentication for external access to all applications. 

As organizations called on their backup sets to recover data that was encrypted by ransomware, the entities behind such attacks have made headway in seeking out and infecting backup data. This has resulted in a recovery attack-loop that re-introduces time-delayed, undetected ransomware onto the network from the backup data. This has negatively impacted recovery for many organizations as it renders the recovery of encrypted files useless, allowing the malware to re-constitute and re-encrypt the primary data again. Therefore, defending recovery data from such attacks using a redundant backup strategy is key as is the deployment of an evolved data protection solution that offers a robust recovery framework.

“Backup and recovery has become recognized as the last line of defense in the continued operation of a business after a crippling malware attack occurs,” said Eran Farajun, Executive Vice President, Asigra. “By taking the necessary steps to tighten security and conducting a review of one’s backup strategy and policies, recovery readiness can be assured for the next round of attacks.”

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.