Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/22/2016
04:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

5 Ways To Protect HR From Ransomware

Bad actors are now looking to hold for ransom sensitive information stored in personnel records in the human resources department and other highly sensitive corporate operations.

This past spring when news of the Petya Ransomware hit, security managers were concerned, but by and large the ransoms were typically in the range of a couple hundred dollars.

But now there are signs that ransomware attackers are going for bigger targets, and more money. Brian NeSmith, co-founder and CEO of Arctic Wolf Networks, warns that the value of the target is much more focused and the ransomware, more sophisticated. “When the ransomware hit a random desktop it was not for as much money,” NeSmith says.

A report recently released by Symantec found that the average ransomware demand jumped to $679 this year – up from $294 in 2015. According to the Symantec report, ransomware attacks peaked in March 2016 at about 56,000 and dipped under 40,000 by the next month.

Steve King, chief operating officer and chief security officer at Netswitch, says instead of encrypting one machine, the bad actors will potentially go after all of the company’s PII. King also warns that ransomware can now sneak into the network.

“In the old days -- which was three months ago -- ransomware would infect a machine when a user clicked on an email or a browser,” King explains. “Now, it can disguise itself as a normal tunneling activity, but then infect the network.”

King adds that that last thing a human resources department manager wants to hear is that all of the company’s PII is being held for ransom. Here are some tips from NeSmith and King on steps security managers can take to protect against ransomware infiltrating HR departments and enterprise networks in general:

1. Cover the basics. Companies should deploy very strong web filters and spam controls. Endpoint tools such as behavioral analytics and sandboxes help detect an invasion, quarantine it, and shut it down. And most importantly, have a data backup plan in which the offsite backup is not connected to the company’s network.

2. User education. Keep in mind that the vast majority of ransomware happens through employee errors. Employees need better guidance on what they shouldn't be clicking on or opening. Teach them only to open files with a .doc, .pdf, or .txt file extension. Circulate a whitelist and blacklist of documents that are fine to open and/or avoid.

3. Detection and response. Continuously monitor for malware and remediate it ASAP to reduce the probability of infection. 

4. Network segmentation. Store the company’s most critical data on a different network segment and restrict access to that network segment and data.

5. Set up a special workstation. To protect the HR department, have the IT staff assign a dedicated laptop to an employee for the explicit purpose of reviewing resumes. And the IT staff should monitor that laptop more thoroughly than the average unit at the company.    

Related Content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27348
PUBLISHED: 2020-12-04
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43...
CVE-2020-16123
PUBLISHED: 2020-12-04
An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing, allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by...
CVE-2018-21270
PUBLISHED: 2020-12-03
Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).
CVE-2020-26248
PUBLISHED: 2020-12-03
In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.
CVE-2020-29529
PUBLISHED: 2020-12-03
HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.