Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/9/2018
12:45 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Increasingly Aggressive Malware Drives IT Pros to Re-Examine Backup Strategies, Solutions

TORONTO – April 4, 2018 – Asigra Inc., a leading cloud backup, recovery and restore software provider since 1986, today highlighted the 2018 Breach Briefing(1), a new report by Beazley Breach Response (BBR) Services which found that the threat from ransomware is far from over. In defense of business continuity across all impacted industries, Asigra is calling for organizations to review their backup policies and double down on redundancy so that multiple remote copies of mission critical backups are available when the next attack occurs.

According to BBR Services, “Ransomware remained a constant threat in 2017, including two notable worldwide attacks. BBR Services saw an 18% increase in ransomware incidents in 2017, and ransomware attacks are still occurring across industries and market segments. And while BBR Services received more notifications of ransomware attacks from smaller companies, notifications from larger companies in the middle market still accounted for 42% of the 2017 ransomware attacks.”(2)

Data protection specialists agree that the number one strategy for recovering data lost to criminal encryption is through a reliable data recovery strategy. However, with strands of ransomware now targeting backup data, organizations must take extra steps to ensure their backup data is clean before conducting a recovery. Regardless of the backup platform used, a redundant data protection strategy should be employed to ensure an effective recovery. This approach requires that multiple copies of the company’s mission critical data are created. These backup sets should be stored on multiple media formats, such as secondary disk storage or the cloud with at least one of the backup data sets stored in an offsite location. Once in place, data policies should also be enhanced to include more regular test recoveries to determine the effectiveness, quality and speed of the recovery.

To avoid Ransomware or other malware variants entering your network(s) in the first place, the report  revealed a number of actions that organizations should take immediately to protect their IT systems against attacks, including:

•       Training employees on the indicators of ransomware and malware, how to identify phishing emails, and how to report suspected incidents;
•       Keeping systems up to date and patch as soon as possible;
•       Enabling automated patching for operating systems and browsers;
•       Segregating networks based on functionality and the need to access resources, including physical or virtual separation of sensitive information;
•       Limiting unnecessary lateral communications within the network;
•       Managing the use of privileged accounts. Implementing the principle of “least privilege.” No users should be assigned administrative access unless absolutely needed. Those with a need should only use them when necessary. Additionally, organizations should limit the use of administrative shares;
•       Configuring access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access;
•       Hardening network devices with secure configurations, including disabling unnecessary services and remote administration protocols. Always change default passwords;
•       Taking advantage of threat intelligence resources including alerts from US-CERT and information provided by regulators for your industry, such as the Health and Human Services (HHS) Office of Civil Rights Privacy and Security listserv, and 
•       Requiring two-factor authentication for external access to all applications. 

As organizations called on their backup sets to recover data that was encrypted by ransomware, the entities behind such attacks have made headway in seeking out and infecting backup data. This has resulted in a recovery attack-loop that re-introduces time-delayed, undetected ransomware onto the network from the backup data. This has negatively impacted recovery for many organizations as it renders the recovery of encrypted files useless, allowing the malware to re-constitute and re-encrypt the primary data again. Therefore, defending recovery data from such attacks using a redundant backup strategy is key as is the deployment of an evolved data protection solution that offers a robust recovery framework.

“Backup and recovery has become recognized as the last line of defense in the continued operation of a business after a crippling malware attack occurs,” said Eran Farajun, Executive Vice President, Asigra. “By taking the necessary steps to tighten security and conducting a review of one’s backup strategy and policies, recovery readiness can be assured for the next round of attacks.”

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29144
PUBLISHED: 2020-11-27
In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or e...
CVE-2020-29145
PUBLISHED: 2020-11-27
In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or description field to a solutionUnitServlet?SuName=UserReferenceDataSU Access Rights Group. In most test cases, session hijacking was also possible by utilizing t...
CVE-2020-29136
PUBLISHED: 2020-11-27
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
CVE-2020-29137
PUBLISHED: 2020-11-27
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
CVE-2020-29135
PUBLISHED: 2020-11-27
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).