Vulnerabilities / Threats

7/22/2016
04:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

5 Ways To Protect HR From Ransomware

Bad actors are now looking to hold for ransom sensitive information stored in personnel records in the human resources department and other highly sensitive corporate operations.

This past spring when news of the Petya Ransomware hit, security managers were concerned, but by and large the ransoms were typically in the range of a couple hundred dollars.

But now there are signs that ransomware attackers are going for bigger targets, and more money. Brian NeSmith, co-founder and CEO of Arctic Wolf Networks, warns that the value of the target is much more focused and the ransomware, more sophisticated. “When the ransomware hit a random desktop it was not for as much money,” NeSmith says.

A report recently released by Symantec found that the average ransomware demand jumped to $679 this year – up from $294 in 2015. According to the Symantec report, ransomware attacks peaked in March 2016 at about 56,000 and dipped under 40,000 by the next month.

Steve King, chief operating officer and chief security officer at Netswitch, says instead of encrypting one machine, the bad actors will potentially go after all of the company’s PII. King also warns that ransomware can now sneak into the network.

“In the old days -- which was three months ago -- ransomware would infect a machine when a user clicked on an email or a browser,” King explains. “Now, it can disguise itself as a normal tunneling activity, but then infect the network.”

King adds that that last thing a human resources department manager wants to hear is that all of the company’s PII is being held for ransom. Here are some tips from NeSmith and King on steps security managers can take to protect against ransomware infiltrating HR departments and enterprise networks in general:

1. Cover the basics. Companies should deploy very strong web filters and spam controls. Endpoint tools such as behavioral analytics and sandboxes help detect an invasion, quarantine it, and shut it down. And most importantly, have a data backup plan in which the offsite backup is not connected to the company’s network.

2. User education. Keep in mind that the vast majority of ransomware happens through employee errors. Employees need better guidance on what they shouldn't be clicking on or opening. Teach them only to open files with a .doc, .pdf, or .txt file extension. Circulate a whitelist and blacklist of documents that are fine to open and/or avoid.

3. Detection and response. Continuously monitor for malware and remediate it ASAP to reduce the probability of infection. 

4. Network segmentation. Store the company’s most critical data on a different network segment and restrict access to that network segment and data.

5. Set up a special workstation. To protect the HR department, have the IT staff assign a dedicated laptop to an employee for the explicit purpose of reviewing resumes. And the IT staff should monitor that laptop more thoroughly than the average unit at the company.    

Related Content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-0624
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.
CVE-2018-20727
PUBLISHED: 2019-01-17
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php.
CVE-2018-20728
PUBLISHED: 2019-01-17
A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php.