Vulnerabilities / Threats

7/22/2016
04:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

5 Ways To Protect HR From Ransomware

Bad actors are now looking to hold for ransom sensitive information stored in personnel records in the human resources department and other highly sensitive corporate operations.

This past spring when news of the Petya Ransomware hit, security managers were concerned, but by and large the ransoms were typically in the range of a couple hundred dollars.

But now there are signs that ransomware attackers are going for bigger targets, and more money. Brian NeSmith, co-founder and CEO of Arctic Wolf Networks, warns that the value of the target is much more focused and the ransomware, more sophisticated. “When the ransomware hit a random desktop it was not for as much money,” NeSmith says.

A report recently released by Symantec found that the average ransomware demand jumped to $679 this year – up from $294 in 2015. According to the Symantec report, ransomware attacks peaked in March 2016 at about 56,000 and dipped under 40,000 by the next month.

Steve King, chief operating officer and chief security officer at Netswitch, says instead of encrypting one machine, the bad actors will potentially go after all of the company’s PII. King also warns that ransomware can now sneak into the network.

“In the old days -- which was three months ago -- ransomware would infect a machine when a user clicked on an email or a browser,” King explains. “Now, it can disguise itself as a normal tunneling activity, but then infect the network.”

King adds that that last thing a human resources department manager wants to hear is that all of the company’s PII is being held for ransom. Here are some tips from NeSmith and King on steps security managers can take to protect against ransomware infiltrating HR departments and enterprise networks in general:

1. Cover the basics. Companies should deploy very strong web filters and spam controls. Endpoint tools such as behavioral analytics and sandboxes help detect an invasion, quarantine it, and shut it down. And most importantly, have a data backup plan in which the offsite backup is not connected to the company’s network.

2. User education. Keep in mind that the vast majority of ransomware happens through employee errors. Employees need better guidance on what they shouldn't be clicking on or opening. Teach them only to open files with a .doc, .pdf, or .txt file extension. Circulate a whitelist and blacklist of documents that are fine to open and/or avoid.

3. Detection and response. Continuously monitor for malware and remediate it ASAP to reduce the probability of infection. 

4. Network segmentation. Store the company’s most critical data on a different network segment and restrict access to that network segment and data.

5. Set up a special workstation. To protect the HR department, have the IT staff assign a dedicated laptop to an employee for the explicit purpose of reviewing resumes. And the IT staff should monitor that laptop more thoroughly than the average unit at the company.    

Related Content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12538
PUBLISHED: 2018-06-22
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage...
CVE-2018-12684
PUBLISHED: 2018-06-22
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
CVE-2018-12687
PUBLISHED: 2018-06-22
tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.
CVE-2018-12688
PUBLISHED: 2018-06-22
tinyexr 0.9.5 has a segmentation fault in the wav2Decode function.
CVE-2018-10002
PUBLISHED: 2018-06-22
ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.