Deliver a Deadly Counterpunch to Ransomware Attacks: 4 Steps

Wayman Cummings and Salva Sinno also contributed to this column.

Nearly 1.5 million new phishing sites are created each month. And more than 850 million ransomware infections were detected in 2018 alone. These statistics illustrate the threat that ransomware poses for every IT professional and every kind of organization.

Ransomware is a specific type of malware designed to encrypt a computer's content until the user pays to get the encryption or recovery key. This halts productivity, affecting business revenue. However, security pros can take decisive action to minimize the impact of ransomware.

The first line of defense is always a good offense. To prevent an attacker from establishing a foothold in an organization's network, organizations should put the following in place:

Minimizing ransomware's impact is about more than just defending systems against attack. It also involves taking action to minimize the impact of breaches as they happen. This is critical, since all systems can be breached by attackers who have sufficient time and resources.

That means putting in place solid incident response (IR) programs. Planning ahead builds confidence in that IR capability. To that end, enterprises should review their IR policies and engage in tabletop exercises. And they should use operational benchmarking to improve their ability to respond before an incident occurs.

Hackers continue to evolve and become more sophisticated with their attacks. So, it is likely that a ransomware attack will breach every enterprise's environment at some point. When that occurs, these four steps will minimize the impact and recover enterprise data:

Step 1: Isolation
Before doing anything else, ensure that the infected devices are removed from the network. If they have a physical network connection, unplug them from that connection. If they are on a wireless network, turn off the wireless hub/router. Also unplug any directly attached storage to try to save the data on those devices. The goal is to prevent the infection from spreading.

Step 2: Identify
This step is often overlooked. By spending just a few minutes figuring out what has happened, enterprises can learn important information such as what variant of ransomware infected them, what files that strain of ransomware normally encrypts, and the options for decryption. Enterprises also may learn how to defeat the ransomware without paying or restoring system(s) from scratch.

Step 3: Report
This is another step that many security professionals ignore, whether due to embarrassment or time constraints. However, by reporting the ransomware attack, enterprises may help other organizations avoid similar situations. Furthermore, they provide law enforcement agencies with a better understanding of the attacker. There are many ways to report a ransomware attack. One is by contacting a local FBI office in the US or registering a complaint with the FBI's Internet Crime Complaint Center website. The Federal Trade Commission's OnGuardOnline website and Scamwatch, an Australian Competition & Consumer Commission effort, also collect such data.

Step 4: Recover
In general, there are three options to recover from a ransomware attack: 

It's simply not possible to keep all ransomware attacks at bay. However, it is possible to ensure that if a breach occurs, it does not spread, affect business, and become a newsworthy event.

By fending off the majority of attacks and dealing swiftly with the bad actors that get in the door — with the help of dynamic isolation, microsegmentation, and other modern cybersecurity technologies — organizations will keep their businesses on track and on target.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Criminals Hide Fraud Behind the Green Lock Icon."