Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
5 Security Resolutions to Prevent a Ransomware Attack in 2020
Newest First  |  Oldest First  |  Threaded View
seven_stones
50%
50%
seven_stones,
User Rank: Apprentice
1/12/2020 | 2:43:11 PM
VM / detection
Would prefer to see something like "mature vulnerability management processes" instead of penetration testing, especially as local controls on Windows devices, believe it or not, even though vendors would have the world believe otherwise, be very effective indeed. 

You mentioned SIEM in your last point, which is fair enough. I'd probably emphasise detection a lot more, mostly because prevention is far from guaranteed to help. At least the organisation can get a heads up of environmental skullduggery before the payload is active. Unlikely, yes, but good to do anyway for so many reasons. 
seven_stones
50%
50%
seven_stones,
User Rank: Apprentice
1/12/2020 | 2:36:16 PM
Re: Deploy key technologies to close critical vectors
Those aspects you mention are critical for mail servers, for security yes, and the organisation will have trouble sending mail to some domains if these aren't in place - there's even a chance they could end up on a spam black list. Awkward. But for preventing malware malicious email, not so useful. Low level phishers can get blocked but its pitifully easy to subvert, and moreover lots of Phishing comes from compromised accounts.
duetqqip
50%
50%
duetqqip,
User Rank: Apprentice
12/21/2019 | 12:40:24 PM
Re: Deploy key technologies to close critical vectors
nice
smtaylor12
50%
50%
smtaylor12,
User Rank: Author
12/19/2019 | 8:00:46 AM
Re: Deploy key technologies to close critical vectors
First of all, thanks for your comment.

The list wasn't meant to be all-inclusive, I've received other good suggestions via Twitter and LinkedIn. Email protections certainly are definitely a good strategy. I think the bottom line is that there is not one singular tactic, tool or solution to completely protect from ransomware. Education, good endpoint protection/patching strategies, complete visibility of what's on the network (to include the risks of those devices), but that visibility should also be from the outside in, ensuring all protections are made on externally facing devices, systems and applications. While I would agree email is a primary target, some of the highest profile breaches/ransomware attacks weren't initiated by email at all.
sethblank
50%
50%
sethblank,
User Rank: Author
12/18/2019 | 7:05:06 PM
Deploy key technologies to close critical vectors
Thanks for the article, Shawn.

There's one crucial item missing from your list. 90+% of cyberattacks, including ransomware, begin from email. And there are well known technologies, such as SPF, DKIM, and especially DMARC, that prevent these abuses before they ever get in front of a user.

These solutions don't cover every scenario, but they cover the majority of the sources of the threats. We've seen in the real world that when an organization has DMARC in place, attackers simply move on to abuse other organizations instead of moving to more difficult vectors.

If you want to stop ransomware, deploy these open standards and you've reduced your threat surface by more than half. Then apply the rest of your recommendations to continue closing the gap.


Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Google Lets iPhone Users Turn Device into Security Key
Kelly Sheridan, Staff Editor, Dark Reading,  1/15/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-16270
PUBLISHED: 2020-01-22
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.
CVE-2018-16271
PUBLISHED: 2020-01-22
The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This a...
CVE-2018-16272
PUBLISHED: 2020-01-22
The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
CVE-2019-10780
PUBLISHED: 2020-01-22
BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.
CVE-2019-10781
PUBLISHED: 2020-01-22
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.