Vulnerabilities / Threats

7/22/2016
04:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

5 Ways To Protect HR From Ransomware

Bad actors are now looking to hold for ransom sensitive information stored in personnel records in the human resources department and other highly sensitive corporate operations.

This past spring when news of the Petya Ransomware hit, security managers were concerned, but by and large the ransoms were typically in the range of a couple hundred dollars.

But now there are signs that ransomware attackers are going for bigger targets, and more money. Brian NeSmith, co-founder and CEO of Arctic Wolf Networks, warns that the value of the target is much more focused and the ransomware, more sophisticated. “When the ransomware hit a random desktop it was not for as much money,” NeSmith says.

A report recently released by Symantec found that the average ransomware demand jumped to $679 this year – up from $294 in 2015. According to the Symantec report, ransomware attacks peaked in March 2016 at about 56,000 and dipped under 40,000 by the next month.

Steve King, chief operating officer and chief security officer at Netswitch, says instead of encrypting one machine, the bad actors will potentially go after all of the company’s PII. King also warns that ransomware can now sneak into the network.

“In the old days -- which was three months ago -- ransomware would infect a machine when a user clicked on an email or a browser,” King explains. “Now, it can disguise itself as a normal tunneling activity, but then infect the network.”

King adds that that last thing a human resources department manager wants to hear is that all of the company’s PII is being held for ransom. Here are some tips from NeSmith and King on steps security managers can take to protect against ransomware infiltrating HR departments and enterprise networks in general:

1. Cover the basics. Companies should deploy very strong web filters and spam controls. Endpoint tools such as behavioral analytics and sandboxes help detect an invasion, quarantine it, and shut it down. And most importantly, have a data backup plan in which the offsite backup is not connected to the company’s network.

2. User education. Keep in mind that the vast majority of ransomware happens through employee errors. Employees need better guidance on what they shouldn't be clicking on or opening. Teach them only to open files with a .doc, .pdf, or .txt file extension. Circulate a whitelist and blacklist of documents that are fine to open and/or avoid.

3. Detection and response. Continuously monitor for malware and remediate it ASAP to reduce the probability of infection. 

4. Network segmentation. Store the company’s most critical data on a different network segment and restrict access to that network segment and data.

5. Set up a special workstation. To protect the HR department, have the IT staff assign a dedicated laptop to an employee for the explicit purpose of reviewing resumes. And the IT staff should monitor that laptop more thoroughly than the average unit at the company.    

Related Content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10869
PUBLISHED: 2018-07-19
redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.
CVE-2018-10870
PUBLISHED: 2018-07-19
redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.
CVE-2018-12959
PUBLISHED: 2018-07-19
The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all contract balances into their account).
CVE-2018-14336
PUBLISHED: 2018-07-19
TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses.
CVE-2018-10620
PUBLISHED: 2018-07-19
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code t...