Minimising The Impact Of Ransomware

Ransomware attacks are growing in size and frequency and are threatening businesses all around the world. As more employees return to offices after working from home for months on end, cyber security dangers are a big concern. Cyber experts say malware or something malicious may be waiting for them on their devices. 
 
The rapid shift to remote working triggered by the pandemic has also underlined significant cyber security threats for employers and employees alike, as the head of the UK’s National Cyber Security Centre recently warned that ransomware has become the biggest threat to British people and businesses. "For the vast majority of UK citizens and businesses, and indeed for the vast majority of critical national infrastructure providers and government service providers, the primary key threat is not state actors but cyber criminals,”  Lindy Cameron said.  

Ransomware is a type of malware commonly used by cyber criminals to make money by extortion.

 
Malware:   Software programs that enable cyber criminals to take over an electronic device once it is infected. The majority of ransomware attacks begin with phishing emails and the cyber criminals hide the malware in an attachment that poses as a benign file, like an invoice or a report. As soon as the victim opens the attachment, the ransomware spreads through their device, locking files and leaving behind a ransom note.
 
• causing a device to become locked or unusable
• stealing, deleting or encrypting data
• taking control of your devices to attack other organisations
• obtaining credentials which allow access to your organisation's systems or services that you use
• 'mining' crypto currency
• using services that may cost you money (e.g. premium rate phone calls).
 
Ransomware:     Is a type of malware that prevents you from accessing your computer and or the data that is stored on it. The computer itself may become locked, or the data on it might be stolen, deleted or encrypted. Once infected, there are numerous ways cyber criminals can leverage the victim’s system for profit, such as collecting credit card data which they then sell, harvesting logins and passwords to people’s bank accounts. They then use the account to steal and transfer money, finding personal information which they leverage for identity fraud, or connect the victim’s computer into a botnet for attacks such as Distributed Denial of Service (DDoS) attacks.  

Ransomware has proven to be one of the fastest and more profitable than almost any other attack. 

Once cyber criminals infect a single computer in an organisation, they do not immediately demand a ransom. Instead, they use that infected system to stealthily infect other computers in the organisation, perhaps even the backups. Not until the cyber criminals believe almost every system has been infected, and not until they have exfiltrated an extensive amount of data will they then enable the ransomware, encrypt all the devices, and notify the organisation. 
 
Should Victims Pay Ransom?:     Law enforcement do not encourage, endorse, nor condone the payment of ransom demands. even f you do pay the ransom,  there is no guarantee that you will get access to your data or computer and you will still be infected.  Attackers will also threaten to publish data if payment is not made. 

Organisations should take measures to minimise the impact of data exfiltration.

In today’s highly organised cyber-criminal world, there are entire organisations dedicated to continually developing malware that cannot be detected. Four key issues to focus on for ransomware are: 
 
Social Engineering:   These types of attacks, especially phishing, are one of the primary methods cyber attackers use to infect systems. Train people on how to spot and stop phishing attacks.
 
Passwords:    Weak or insecure passwords are another very common way cyber attackers break into organisations today. Provide the training and tools to ensure people are using strong passwords.
 
Updating:    Updated and current systems are much harder for cyber attackers to infect with malware. We want to ensure people are always using the most current operating systems and applications. In some cases, you may want to emphasise the importance of enabling automatic updating.
 
Training:    Lessons for your workforce on how to report a suspected infected computer. Ensure they feel comfortable reporting, even if they know they caused the infection. 
 
If your organisation has a punitive or toxic security culture, people may be hesitant or even afraid to report they caused an infected system, so avoid a 'blame' culture and make sure  employees feel comfortable reporting.
 
NCSC:       Heimdal Security:     Hornet Security:    Cloudwards:   IT Governance:     Tripwire:    Komo News:  
 
Legal Futures:      Chainanalysis:        HLB Global:       SANS:       Image: Unsplash
 
You Might Also Read: 
 
US Companies Aren’t Preparing For Cyber Attacks:
 
 
« CYRIN Have Created Some New Training Options
Britain’s National Cyber Security Strategy »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Homeland Security Advanced Research Projects Agency (HSARPA)

Homeland Security Advanced Research Projects Agency (HSARPA)

HSARPA's Cyber Security Division (CSD) was set up to address DHS cyber operational and critical infrastructure protection requirements.

Thales

Thales

Thales provides solutions, services and products that help its customers in the defence, aeronautics, space, transportation and digital identity and security markets to fulfil their critical missions.

Dionach

Dionach

Dionach are a certified information security specialists who provide Penetration Testing, IT Security Auditing and Information Security Consultancy.

Cyber Aware

Cyber Aware

Cyber Aware aims to drive behaviour change amongst small businesses and individuals, so that they adopt simple secure online behaviours.

Ikerlan

Ikerlan

Ikerlan is an R&D technology centre specialising in areas including embedded systems, industrial automation and industrial cybersecurity.

Professional Insurance Agents (PIA)

Professional Insurance Agents (PIA)

Professional Insurance Agents (PIA) offer commercial insurance services including Cyber Liability insurance.

Apricorn

Apricorn

Apricorn provides hardware-based 256-bit encrypted external storage products to companies and organizations that require high-level protection for their data at rest.

The Security Awareness Company (SAC)

The Security Awareness Company (SAC)

The Security Awareness Company provides cyber security awareness training programs for companies of all sizes.

Uppsala Security

Uppsala Security

Uppsala Security built the first crowdsourced Threat Intelligence platform known as the Sentinel Protocol, which is powered by blockchain technology.

Startupbootcamp Fintech & Cybersecurity

Startupbootcamp Fintech & Cybersecurity

Startupbootcamp is the world’s largest network of multi-corporate backed accelerators helping startups scale internationally.

Toothpic

Toothpic

ToothPic has invented, designed, developed and patented a solution to enable companies to turn every smartphone into a secure key for a user-friendly online authentication.

TWC IT Solutions

TWC IT Solutions

Since 2011, TWC IT Solutions has offered managed IT Support, Cybersecurity, Disaster Recovery, Contact Centre and Business Connectivity services to clients across 24 countries globally.

CodeHunter

CodeHunter

CodeHunter is a malware hunting SaaS platform designed to detect all variations of malware, known and unknown, without the need for source code or signatures.

CyberMaxx

CyberMaxx

At CyberMaxx, our approach to cybersecurity provides end-to-end coverage for our customers – we use offense to fuel defense.

Treacle Technologies

Treacle Technologies

Treacle Technologies are a Cyber Security startup with a focus on Defensive Security.

InfoTrust

InfoTrust

InfoTrust is a leading specialised cybersecurity practice that combines a customer-first consulting approach with next-generation security solutions.