Attackers are utilising forms of benign malware—such as software designed to cause distributed denial-of-service (DDoS) attacks or launching display ads on thousands of systems— to unleash huge outbreaks of ransomware. Botnet operators will grant ransomware attackers access to botnet nodes in exchange for payments, allowing them to significantly expand the scope of a ransomware attack.
Attackers will continue to launch scatter-gun-style attacks to disrupt as many systems as possible, we are also seeing increasing instances of attackers targeting specific companies and demanding ransomware payments proportional to the value of the encrypted assets. This can be quite significant in an event where cyber criminals manage to get their hands on sensitive and distinguishable client information, of which there has been ample, high-profile examples in South Africa.
To achieve stronger returns in these targeted attacks, criminals will hit environments where access to data and systems is mission critical, such as hospitals, transportation companies and manufacturing companies. We can also expect to see an increase in the use of ransomware to infect IoT devices, which come with a diminished set of security features by default to facilitate out-of-the-box functionality, and users tend to maintain these original settings once the devices start functioning.
In addition, cryptocurrencies will continue to support the flourishing ransomware industry overall, despite law enforcement becoming more advanced in their ability to trace attacks, for example, through bitcoin wallets.
Addressing the issue
Companies will have to go beyond the vital step of creating backups, to protect themselves. Companies will need to utilise systems that can create snapshots in time or maintain multiple versions of files created over the course of the day, to enable restoration to a specific point in time prior to the backup with minimal loss of productivity. Security professionals will need to routinely test if their backups allow them to restore the data and files in a specific time-frame to ascertain the downtime the company can withstand if a ransomware attack is realised.
We will also see more companies recognising the need to implement the Principle of Least Privilege—limiting file access rights for users to the bare minimum permissions they need to perform their work to reduce the number of files that could be encrypted in the event of a ransomware attack. Advanced companies will need to grant employees only the access needed for the business activities of a specific function, rather than providing automatic access to everything.
With perpetrators carrying out wide-scale, profitable, and disruptive attacks in recent years, the number of attackers, the volume of ransomware families, and the number of infections increased dramatically. The trend is continuing, with attackers launching large-scale attacks, but also evolving their tactics to implement targeted attacks with demands for greater payments proportional to the value of the assets. This activity will be supported by the continued rise of cryptocurrencies.
The following questions will give an indication on how risk ready your organisation is to face a ransomware attack:
- When was the last time you reviewed your company’s patch management program? Your disaster recovery and business continuity plans?
- Can you identify where all your mission critical data resides and whether regular backups are being made?
- Does your cyber insurance policy provide adequate coverage? Have you taken the necessary steps to ensure you will be eligible to make a claim if your company is impacted?
- Have you communicated with employees about the latest phishing and social engineering techniques?
- Do you have an incident response plan in place, and has it recently been tested so everyone knows what to do in the event of an attack?
- Are all necessary technical and procedural controls in place and operating properly?
- Has your security posture recently been assessed and tested, and have you acted on the results?
Whether you are a big or small operator, your company’s ability to protect against and recover from ransomware attacks rely on implementing proactive technical measures and business continuity plans. That is why you need a qualified risk advisor by your side who can take your business through a comprehensive cyber risk assessment in order to mitigate the risk of unwarranted access to your most crucial data.
Source: Financial Intermediaries Association (FIA)