Attacks/Breaches

4/9/2018
12:45 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Increasingly Aggressive Malware Drives IT Pros to Re-Examine Backup Strategies, Solutions

TORONTO – April 4, 2018 – Asigra Inc., a leading cloud backup, recovery and restore software provider since 1986, today highlighted the 2018 Breach Briefing(1), a new report by Beazley Breach Response (BBR) Services which found that the threat from ransomware is far from over. In defense of business continuity across all impacted industries, Asigra is calling for organizations to review their backup policies and double down on redundancy so that multiple remote copies of mission critical backups are available when the next attack occurs.

According to BBR Services, “Ransomware remained a constant threat in 2017, including two notable worldwide attacks. BBR Services saw an 18% increase in ransomware incidents in 2017, and ransomware attacks are still occurring across industries and market segments. And while BBR Services received more notifications of ransomware attacks from smaller companies, notifications from larger companies in the middle market still accounted for 42% of the 2017 ransomware attacks.”(2)

Data protection specialists agree that the number one strategy for recovering data lost to criminal encryption is through a reliable data recovery strategy. However, with strands of ransomware now targeting backup data, organizations must take extra steps to ensure their backup data is clean before conducting a recovery. Regardless of the backup platform used, a redundant data protection strategy should be employed to ensure an effective recovery. This approach requires that multiple copies of the company’s mission critical data are created. These backup sets should be stored on multiple media formats, such as secondary disk storage or the cloud with at least one of the backup data sets stored in an offsite location. Once in place, data policies should also be enhanced to include more regular test recoveries to determine the effectiveness, quality and speed of the recovery.

To avoid Ransomware or other malware variants entering your network(s) in the first place, the report  revealed a number of actions that organizations should take immediately to protect their IT systems against attacks, including:

•       Training employees on the indicators of ransomware and malware, how to identify phishing emails, and how to report suspected incidents;
•       Keeping systems up to date and patch as soon as possible;
•       Enabling automated patching for operating systems and browsers;
•       Segregating networks based on functionality and the need to access resources, including physical or virtual separation of sensitive information;
•       Limiting unnecessary lateral communications within the network;
•       Managing the use of privileged accounts. Implementing the principle of “least privilege.” No users should be assigned administrative access unless absolutely needed. Those with a need should only use them when necessary. Additionally, organizations should limit the use of administrative shares;
•       Configuring access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access;
•       Hardening network devices with secure configurations, including disabling unnecessary services and remote administration protocols. Always change default passwords;
•       Taking advantage of threat intelligence resources including alerts from US-CERT and information provided by regulators for your industry, such as the Health and Human Services (HHS) Office of Civil Rights Privacy and Security listserv, and 
•       Requiring two-factor authentication for external access to all applications. 

As organizations called on their backup sets to recover data that was encrypted by ransomware, the entities behind such attacks have made headway in seeking out and infecting backup data. This has resulted in a recovery attack-loop that re-introduces time-delayed, undetected ransomware onto the network from the backup data. This has negatively impacted recovery for many organizations as it renders the recovery of encrypted files useless, allowing the malware to re-constitute and re-encrypt the primary data again. Therefore, defending recovery data from such attacks using a redundant backup strategy is key as is the deployment of an evolved data protection solution that offers a robust recovery framework.

“Backup and recovery has become recognized as the last line of defense in the continued operation of a business after a crippling malware attack occurs,” said Eran Farajun, Executive Vice President, Asigra. “By taking the necessary steps to tighten security and conducting a review of one’s backup strategy and policies, recovery readiness can be assured for the next round of attacks.”

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: White Privelege Day
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17282
PUBLISHED: 2018-09-20
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVE-2018-14592
PUBLISHED: 2018-09-20
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
CVE-2018-15832
PUBLISHED: 2018-09-20
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI ha...
CVE-2018-16282
PUBLISHED: 2018-09-20
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
CVE-2018-16752
PUBLISHED: 2018-09-20
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.