Ransomware attacks have been lighting up the newswire for a few years now, and they aren’t going away anytime soon. According to TechCrunch, 2022 was the worst year on record for ransomware attacks, with increases of 80% year-over-year.
The Rise of Data Extortion
It’s true; ransomware is becoming more dangerous than ever. With the expansion of data extortion via more sophisticated malware, threat actors aren’t only demanding money; they’re removing sensitive data from the systems they attack. This type of ransomware can come with a huge security price tag that can ruin a company’s reputation for many years.
Unauthorized data exfiltration can be accomplished in several ways. For example, a threat actor could access a compromised corporate email account to send and receive files outside of the network–the credentials for this access were obtained during the initial ransomware attack. Then, they could use malware, open-source penetration testing tools, or other well-known techniques to move freely through the organization’s network. This access allows them to target the critical data they need to run their data extortion campaigns. Below is a typical infection process, as outlined by cisecurity.org.
10 Top security tips for your business:
Every company, no matter its size, should be concerned about ransomware, particularly given the rise in data extortion. Here are some steps businesses can take to ensure they are both protected and prepared for an attack.
- Enable Email Filtering: With phishing emails the first fault line for many ransomware attacks, setting up content rules for your organization’s emails is the first step. Partnering with a provider like Libraesva ensures your email security, including filtering, is nearly impenetrable.
- Invest in AI Threat Detection & Response Technology: AI technology is on the rise, and threats from AI-powered bad actors come with it. Look for solutions considering Machine Learning, Computer Vision, and Natural Language Processing to help detect malicious activity. Then, implement solutions that provide continual scanning and automatic remediation to ensure your organization has ongoing protection.
- Encourage User Awareness Training: Human error continues to be the number one driver of successful online attacks. According to IBM and the Ponemon Institute, 21% of data breaches globally in 2021 were caused by human error. Consider regular automated training and ongoing threat detection exercises to keep employees vigilant.
- Consider Blocking 3rd-Party File-Sharing Services: If your organization can find other solutions, consider blocking third-party file-sharing sites such as Dropbox. These sites offer an easy way to exfiltrate moderate volumes of data easily.
- Build an Incident Response & Communication Plan: Create and maintain a cyber incident response plan with response and notification procedures and other communications plans so that you are prepared in the event of an attack.
- Implement DMARC Policy & Verification: DMARC beefs up your security by expanding on the Sender Policy Framework and Domain Keys Identified Mail protocols through the addition of policy enforcement and a reporting function for senders and receivers.
- Vet MSPs: MSPs are often a “weak link” in organizations’ security policies. Consider the risk management and cyber hygiene practices of all 3rd parties your company uses.
- Adopt Zero Trust Security Policies: By adopting Zero Trust security, you make it harder for hackers to harm your network after achieving initial access through the use of technologies like multi-factor authentication (MFA), access controls, and network segmentation.
- Implement Password Protection Policies: Ensure employees are using secure passwords via security training, password protocols, regular refreshes, password managers, and other related methods.
- Consider Threat Detection Tools & Maintain Ongoing Logs: Analyze tactics and tools to detect threats from the start, such as an intrusion detection system (IDS), an intrusion prevention system (IPS), or an Endpoint Detection and Response (EDR) solution. Then, baseline network activity over time will be analyzed to determine behavioral patterns. Determining what constitutes normal activity is a major step in detecting malicious network activity.
Click here to learn how ransomware works.
Need help building your organization’s ransomware protection plan?
Click here to contact us!
