News & Commentary

2/26/2015
10:30 AM
Alexandra Gheorghe
Alexandra Gheorghe
Partner Perspectives
Connect Directly
Twitter
LinkedIn
Google+
RSS
50%
50%

How to Strengthen Enterprise Defenses against Ransomware

Eight essential ways that companies can enforce their borders.

In 2014, death reached a man through the Internet. A 36-year-old Romanian, who had been surfing porn sites, committed suicide after a notice from a computer virus threatened him with prison unless he paid a “fine” of thousands of dollars. The virus was IcePol ransomware.

This devastating breed of malware is getting ever-more dangerous, reaching new levels of complexity as it hits smartphones and tablets that store crucial personal and enterprise-level documents. Unfortunately, encrypted communications between attackers and elusive infection workflows make it difficult for traditional detection-based security solutions to detect and block ransomware.

Ransomware has become a growing menace for companies, targeting employees with ingeniously crafted messages and techniques. More than once, employees have proven to be companies’ weakest links, especially since companies have embraced the BYOD/BYOA trend. As we’ve seen with previous incidents, a successful intrusion can cause tremendous damage: destruction of sensitive or proprietary information, disruption of operations, and huge financial and reputation losses. Attackers usually aim at targeted files, databases, CAD files, and financial data. For example, the infamous CryptoLocker was used to encrypt more than 70 different file extensions, including .doc, .img, .av, .src, and .cad.

Where should businesses intervene to prevent becoming vulnerable to ransomware? Here are eight essential recommendations for companies looking to bolster their defenses:

  1. Educate employees in good computer practices and in identifying social engineering attempts and spear-phishing emails. Downloading attachments from unsolicited emails and accessing compromised sites after clicking pop-up ads are two of the most frequent vectors of infection with ransomware. Newer variants of ransomware have also been seen to spread through removable USB drives or IM clients, with the payload disguised as an image.
  2. Install, configure, and maintain an advanced endpoint security solution. A multilayered security solution will include an intrusion-detection system with behavior-blocking components that monitor devices and look for actions typically initiated by malware.
  3. Enable software restriction policies to allow only specifically identified applications to run. These measures will reduce the risk of infection by restricting scripts and other untrusted apps from running.
  4. Use a firewall to block all incoming connections. An advanced firewall solution includes security capabilities such as intrusion prevention, content/URL filtering, and encrypted traffic inspection. This helps prevent attacks and unauthorized network traffic and, ultimately, protects an organization’s most critical assets.
  5. Make sure programs and users have the lowest level of privileges necessary to complete a task. When prompted for a root or UAC password, ensure that the program asking for administration-level access is a legitimate application
  6. Enable system restore to recover the previous versions of encrypted files. System restore allows you to boot your system and to restore your computer to a known clean state. Bear in mind that it might not work with all types of malware.
  7. Deploy and maintain a comprehensive backup solution. Cloud-based disaster recovery can be an efficient option for data storage, helping organizations to remain agile regardless of the catastrophe – human error, malware infection, or natural disaster.
  8. Make sure all systems and software are up to date with relevant patches. Needless to say, ransomware takes advantage of vulnerabilities in outdated software – such as browser plugins like Flash Player, Java, and Adobe Reader – to corrupt systems.

Ransomware is a powerful and sophisticated threat that can be re-engineered in ways that thwart traditional layers of defense. That is why businesses, financial institutions, government agencies, academic institutions, and other organizations carrying highly sensitive data should make use of all the security measures available to enforce their borders.

Alexandra fulfills the Security Specialist role for Bitdefender, performing writing duties such as security news for Bitdefender's security blog, as well as marketing and PR materials. She started writing about online security at the dawn of the decade - after 3-years in ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
3/1/2015 | 2:57:49 AM
Honeypot the employees
One technique that some companies engage in (and consultants advise) is to purposely send "phishing" emails to a random selection of employees each month.  If the employee clicks, he is advised that it was a phishing email and he is required to complete a brief, five-minute training session online.

From what I understand, it works like a charm in reducing successful phishing attempts while fostering a strong security culture.
aws0513
100%
0%
aws0513,
User Rank: Ninja
2/27/2015 | 1:13:14 PM
The Basics
A good article that would be presentable to organization managers.

Of course, this is the 50,000 ft level.  There are so many security controls to consider that it is easy to get lost in the forest of things that should be in place without knowing if there is a path out of the maze.

When I work with organizations struggling with how to implement an information security program, I talk about the same things provided in the article, but within the Critical Security Controls (CSC) framework.  The CSC framework helps managers prioritize efforts to establish a foundation of security controls from the ground up.  Some controls just need to be operationalized before other controls can be effective.
For regulatory data environments, the CSC maps out very well to other security control and risk management frameworks.

In the end, the concepts of least privilege, least functionality, separation of duties, and need-to-know are the concepts that all employees need to learn and understand, not just in IT, but in any information handling environment. 
I dare say that end users...  customers...  the general public... also need to know those core concepts.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/27/2015 | 10:20:25 AM
Great Points!
All these points are great, but 4, 5 and 7 rank highest in priority for me with something like cryptolocker and other ransomware. I think in situations like this it is important to have a means of recovering your files as expediently as possible while not allowing the infiltrating software to glean upper level credentials and I feel 4, 5 and 7 are strong points in this regard.
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12697
PUBLISHED: 2018-06-23
A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.
CVE-2018-12698
PUBLISHED: 2018-06-23
demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump.
CVE-2018-12699
PUBLISHED: 2018-06-23
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.
CVE-2018-12700
PUBLISHED: 2018-06-23
A Stack Exhaustion issue was discovered in debug_write_type in debug.c in GNU Binutils 2.30 because of DEBUG_KIND_INDIRECT infinite recursion.
CVE-2018-11560
PUBLISHED: 2018-06-23
The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.