Ransomware Protection Best Practices

The Evolution of Ransomware

Ransomware attacks have changed significantly in the past several years. Some of the major phases in the evolution of ransomware include the following:

• The Original Ransomware: Ransomware is malware that encrypts valuable files and demands a ransom for their return.
• Ransomware as a Service (RaaS): With RaaS, role specialization emerged in the ransomware space. Ransomware developers provided their malware to affiliates, who deployed it on target systems for a cut of the profits.
• Double Extortion: As companies began recovering from backups rather than paying ransoms, ransomware gangs began double extortion attacks. Before encrypting files, the ransomware operators would steal them and threaten to leak them if the ransom is not paid.
• Triple Extortion: Triple extortion attacks widened the scope of ransomware’s effects. In addition to the original target, ransomware operators would extort payments from their suppliers and customers as well.
• Intermittent Encryption: Encrypting an entire file can be slow and increases ransomware’s probability of discovery. Intermittent encryption involves only encrypting parts of a file to speed up encryption while still rendering the data unusable.

Ransomware Protection Best Practices

Ransomware is currently one of the most significant threats to corporate cybersecurity, and many companies are impacted each year. However, there are ways to protect your organization and its data against the ransomware threat.

Some ransomware protection best practices include the following:

• Deploy Anti-Ransomware Solutions: An anti-ransomware solution can identify known and novel ransomware based on their behavior on a system. Effective anti-ransomware solutions offer fast detection of a wide variant of variants and automatic restoration of encrypted files that is not based on “Shadow Copy” or other built-in tools commonly targeted by ransomware.
• Cybersecurity Awareness Training: Most ransomware attacks target employees, using phishing or credential theft to gain access to corporate systems. Training employees to recognize common attacks and implement security best practices can reduce ransomware risk.
• Use Strong Authentication: Account takeover attacks are a common means by which ransomware gains access to target systems. Requiring strong passwords and implementing multi-factor authentication (MFA) can reduce the risk of attackers gaining access to corporate systems.
• Implement Least Privilege: Often, attackers need to move laterally through a network to reach systems with high-value data to encrypt. Implementing least privilege and network segmentation can make this lateral movement harder to perform and easier to detect.
• Patch Vulnerable Software: Exploitation of unpatched vulnerabilities is one of the main ways that ransomware gains access to corporate environments. Promptly applying patches when they become available minimizes the window during which an attacker can exploit a newly-discovered vulnerability to deploy ransomware.
• Generate Frequent Backups: Backups offer a recovery option after a ransomware attack. Creating frequent, read-only backups can reduce the amount of data lost due to encryption.