Ransomware preparedness

In the previous section, we introduced many of the threats and cyberattacks that continue to challenge us as cybersecurity professionals. One specific type of malware we want to cover in more detail is ransomware. Since the original release of this publication, ransomware incidents have grown exponentially, and ransomware is currently one of the biggest threats to organizations today. In short, a ransomware attack refers to an intruder encrypting data belonging to a user or organization, making it inaccessible. For the user or organization to gain access back to their data, they are held to a ransom in exchange for the decryption keys. The intruders will use many tactics to try to force payment, including threats to leak the data and list the data for sale on the dark web, to the extent of erasing backups, to name a few.

Ransomware has been around for a long time, and the first documented incident occurred in 1989, known as PC Cyborg or the AIDS Trojan. Since then, ransomware has evolved substantially into a business with high payoffs for attackers. There is even a ransomware-as-a-service (RaaS) model that allows hackers to subscribe and use the service to commit their own attacks. A report released by the Federal Bureau of Investigation’s (FBI’s) Internet Crime Complaint Center (IC3) (https://www.ic3.gov/) received 2,084 ransomware incidents between January and July 2021 alone. The cost of complaints from the 2,084 incidents totaled over US dollars (USD) $16.8 million. This is a 62% increase in reported incidents and a 20% increase in losses from the same period in 2020. These numbers alone show a significant increase in ransomware. You can read more on the report here: https://www.ic3.gov/Media/News/2021/210831.pdf.

When it comes to ransomware (or any other threat), the first action should be to protect your environment as best as possible. Although there is a lot that can be done to prevent ransomware from occurring, there is no way to make your environment 100% resilient from such an attack. Because of this, the second action you need to take is being prepared to respond. Ransomware can impact anyone at any time, and the better prepared you are, the better you will be able to handle the situation and the quicker you will be able to recover your environment. Time is of the essence in these situations as you may be losing millions of dollars, customers, and a reputation that has taken years to build.

There are many great resources available for ransomware preparedness and response. Our review of ransomware preparedness and response will be referencing the following two excellent resources for recommendations and information:

• Cybersecurity and Infrastructure Security Agency (CISA): https://www.cisa.gov/stopransomware
• NIST: https://csrc.nist.gov/projects/ransomware-protection-and-response

First, let’s review some best practices for protecting your environment from a ransomware attack. A lot of the following recommendations should be part of your standard security best practices, but it’s best to review and validate any gaps you may have in your infrastructure:

• Enforce MFA, use least privileges or just-enough privilege, and implement Privileged Access Management (PAM) and Privileged Identity Management (PIM).
• Patch and update all software and OSs (including network devices) to the latest supported versions.
• Ensure you are using the latest protection solutions including EDR or Extended Detection and Response (XDR).
• Implement next-generation network protection: firewalls, Intrusion and Detection Prevention (IDP), Intrusion Prevention Systems (IPSs), and so on.
• Implement network segmentation.
• Restrict the use of scripting to approved users.
• Secure your Domain Controllers (DCs).
• Block access to malicious sites.
• Only allow trusted devices on your network.
• Disable the use of macros.
• Only allow approved software to be used by your users.
• Remove local admin permissions.
• Enable advanced filtering for email.
• Use Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).
• Block the Server Message Block (SMB) outbound protocol and remove outdated versions.
• Follow best practices to harden your end-user and infrastructure devices.
• Protect your cloud environment with best practices, especially public file shares.
• Review your remote strategy and ensure outside connections into your environment are secure. If Remote Desktop Protocol (RDP) is needed, ensure best practices are deployed.
• For backups, maintain an offline backup or air gap, encrypt all backups, and validate recovery by testing regularly.
• Implement and focus attention on a well-defined Vulnerability Management Program (VMP).
• Implement a good cybersecurity and awareness program. Train users not to click on links or open attachments unless they are confident they are legitimate.
• Build a mature Vendor Risk Management (VRM) program.

This is a very high-level summary and may not be inclusive of everything that you may need to account for when protecting your network from a ransomware attack. This is a great starting point, but a lot of effort and time will be needed to best protect against malicious attackers.

Additional Information

The preceding list has been derived from the CISA Ransomware Guide (https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware Guide_S508C_.pdf) and the NIST Tips and Tactics | Preparing Your Organization for Ransomware Attacks document (https://csrc.nist.gov/CSRC/media/Projects/ransomware-protection-and-response/documents/NIST_Tips_for_Preparing_for_Ransomware_Attacks.pdf), which contain a lot more detail for review.

As already stated, there is no way of completely preventing a ransomware attack in any environment—it could happen to anyone. No matter how much you protect your environment, there will always be a way to circumvent it. Because of this, the next best action you can take is responsiveness. Being prepared and ready to respond to a ransomware attack will allow you to handle the situation much more efficiently and get your environment up and running much faster. Here are some critical items to help with your response:

• Have an up-to-date Incident Response Plan (IRP). This should include all critical information needed to respond to a ransomware attack, including contact information (local law enforcement), responsibilities, communications, and so on.
• Ensure you have a ransomware playbook as part of your IRP.
• Ensure you have a well-documented Disaster Recovery (DR) plan and Business Continuity Plan (BCP) that is up to date and tested.
• Ensure you have a mature Security Operations Center (SOC) or Managed Security Service Provider (MSSP).
• Conduct a tabletop exercise using ransomware as your theme. Ensure executives are involved in these exercises as they will ultimately need to make some of the important final decisions.
• Carry cybersecurity insurance and understand what options are available with ransomware payment from your cyber insurance policy if this becomes a decision point. Check if you need to obtain a cryptocurrency account or if this is part of the service they provide. Make sure you are not breaking any laws if payment will proceed.
• At a minimum, contract with a couple of respected Incident Response (IR) vendors with whom you have Service Level Agreements (SLAs) for engagement. Ensure that they also provide Digital Forensics Incident Response (DFIR) and are approved for use by your cybersecurity insurance policy. A couple to review are Secureworks (https://www.secureworks.com/services/incident-response/incident-management-retainer) and KPMG (https://advisory.kpmg.us/services/cyber-response-services.html).

  Information

  We will cover the IRP in more detail in Chapter 14, Security Operations.

Everything we have covered for ransomware response should be part of the overall hardening of your environment as part of your security program. Implementing these recommendations will help protect you against many threats. In addition, having an IRP is intended for any security incident within your environment, and this should be a requirement for your security program in general. As we take you through this book, you will learn how to harden your Windows environment to best protect yourself from a ransomware attack.