Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

2/27/2020
02:00 PM
Connect Directly
LinkedIn
RSS
E-Mail vvv
0%
100%

How We Enabled Ransomware to Become a Multibillion-Dollar Industry

As an industry, we must move beyond one-dimensional approaches to assessing ransomware exposures. Asking these four questions will help.

Ransomware has been around for more than 15 years, yet it continues to be the most pervasive cyberthreat facing businesses. According to reports, in 2019 alone more than 966 government agencies, educational establishments, and businesses in the US were hit by ransomware attacks, at a potential cost exceeding $7.5 billion. And, unfortunately, when organizations choose to pay a ransom, they are adding fuel to the fire by supporting this global criminal industry.

The US is home to the world's leading technology companies, so why haven't we solved the ransomware problem by now? The answer is simple: We underestimated the challenge of finding and fixing software vulnerabilities used by ransomware. In the process, we created the perfect environment for a pandemic to take hold and thrive.

For the vast majority of organizations, both large and small, locking the windows and doors used by ransomware in their corporate networks is beyond their capabilities. But it's not for lack of trying.

Most companies routinely perform unauthenticated scans of devices on their IT network looking for vulnerabilities. But unauthenticated scans do not detect as many vulnerabilities as security scans performed as a logged-in (authenticated) user. Of the vulnerabilities they find, companies typically strive to fix the ones ranked as critical or high in severity, primarily to reduce the number of fixes, or patches, that need to be applied. Fixing "every" security vulnerability is beyond the reach of even the largest and best-resourced companies in the world.

However, due to the complexity of the average corporate network, this approach creates a never-ending treadmill where companies are never able to successfully patch all of the critical and high-severity vulnerabilities before new ones are discovered.

Even eliminating all high-severity vulnerabilities doesn't solve the problem because it means a large percentage of others (low and medium risk) are never evaluated for their potential to expose the company to a ransomware attack. For example, the high-severity selection criteria ignores the business criticality of affected devices. Are they running the company's financial systems? Or are they reachable from the Internet?

In addition, the traditional high-severity ranking approach doesn't take into account whether a particular vulnerability is being actively used by ransomware. Without a more comprehensive assessment of security vulnerabilities, it's virtually impossible for companies to know how at risk they really are because of ransomware, and whether they are making forward progress against reducing their risk.

To get the best possible assessment of an organization's risk of being victimized by ransomware, an authenticated scan — which determines how secure a network is from an inside (authenticated user's) vantage point — is needed. While unauthenticated scans can probe a system and deliver a surprising amount of detail, they don't see everything. For example, they will find a good number of vulnerabilities but may have to flag them as potential threats, since they lack the visibility to provide 100% certainty. With ransomware now targeting the application layer, it's crucial that authenticated scans are used to validate whether a patch management program is doing its job and gather data needed to improve processes going forward.

Penetration testing is another important tool in the fight against ransomware and should be performed periodically. Beyond ransomware and other threats, this type of testing offers the important benefit of validating that your controls are working properly. However, like compliance assessments, a single penetration test provides only a point-in-time view of a company's security posture. Continuous penetration testing is the proper approach.

As an industry, we must move beyond one-dimensional approaches to assessing ransomware exposures. Meanwhile, business leaders and boards should be asking for specifics pertaining to an organization's security posture and exposure to ransomware attacks.

For example:

  • What is our organization's risk of being compromised by a ransomware attack?
  • How do we measure our exposure to being victimized by ransomware?
  • What steps are we taking to proactively lower our risk to ransomware attacks?
  • How are we monitoring our progress toward lowering ransomware risk on an ongoing basis?

This line of inquiry will enable the C-suite to assess whether the organization is being reactive or proactive toward the ransomware threat and help understand whether additional investments are required to reduce the company's attack surface.

Related Content:

 

Dr. Srinivas Mukkamala is co-founder and CEO of RiskSense and a former advisor to the U.S. Department of Defense and U.S. Intelligence Community. He is an expert on malware analytics, breach exposure management, web application security, and enterprise risk reduction. Dr. ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
mprogers
50%
50%
mprogers,
User Rank: Apprentice
3/5/2020 | 1:37:40 PM
Flash Poll: Other - why would the political climate matter?
Security shoudl be something we all take seriously.  More seriously over time as threats increase.

The poll borders on ludicrous, but perhaps that's why there are so many vitcims out there.

The current political climate does not make cybersecurity more, or less, important.  Russian bots and Nigerian princes are always with us, as well as web redirects to tiny island nations who don't care about criminals using their web domain as long as money comes in!

Equally amazing as asking such a question is the responses saysing they are waiting on the Trump administration!  No matter how good, or bad, you think Trump is, big government is not where you will find competent help!
ConcernedCitizen
50%
50%
ConcernedCitizen,
User Rank: Apprentice
2/27/2020 | 4:31:19 PM
Q: How Did We Enable Ransomware to Become a Multibillion-Dollar Industry?
A: Microsoft.  Every ransomware incident is because of insecure MS Windows.  MS is never mentioned as having any responsibilty yet they are the basis of the hacks.

Bill Gates: Trustworthy Computing


...more important than any of these new capabilities is the fact that it is designed from the ground up to deliver Trustworthy Computing. What I mean by this is that customers will always be able to rely on these systems to be available and to secure their information.

 
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-20001
PUBLISHED: 2021-03-07
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
CVE-2021-27363
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...