![DR Technology Logo DR Technology Logo](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt4c091cd3ac9935ea/653a71456ad0f6040a6f71bd/Dark_Reading_Logo_Technology_0.png?width=700&auto=webp&quality=80&disable=upscale)
News, news analysis, and commentary on the latest trends in cybersecurity technology.
Darktrace's Max Heinemeyer on Interrupting Ransomware Before Encryption
The latest episode of Tech Talk outlines how organizations can interrupt malicious activity before files get encrypted.
Ransomware attacks may be fast, but they are still made up of several distinct stages — which means security defenders have multiple opportunities to stop the attack before it causes serious damage.
These attacks are, first and foremost, a human intrusion and follow all the familiar phases associated with security breaches, says Max Heinemeyer, director of threat hunting at Darktrace. The malware's actual capabilities and specific techniques vary, but the attack always involve initial access, communicating with a command-and-control server, reconnaissance, and lateral movement. Encryption is often at the end of, or near the end of, the attack life cycle.
In this Tech Talk (above), Heinemeyer outlines how organizations need to know what "normal" looks like in order to detect outliers, and to be able to interrupt those unusual activities as they occur.
"If you want to interrupt ransomware before it can deploy, the previous stages of that attack are very interesting to look at," Heinemeyer says.
The increasing professionalization of ransomware attacks, especially in how the attackers market themselves and recruit new members, worries Heinemeyer. Attacks have evolved from just encrypting everything to extortion, and then to mixing in other attacks in order to collect the ransom. It's possible that future attacks will involve going down the supply chain if the victims don't pay.
"It's all about interrupting business and interrupting revenue ... we don't think this is just a tech issue about encrypting data anymore," Heinemeyer says.
Note: DR Technology is sponsored by Darktrace.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024