A startling number of security professionals, when asked about ransomware readiness, admit that they do not feel confident they have the right tools, processes, or people in place. In fact, many organizations, across both the public and private sectors, often struggle to identify and implement the right solutions for ransomware prevention in the first place.
The main reason for this disconnect tends to center on a few key misconceptions about ransomware. Take for instance, the thought that endpoint protection is all an organization needs. If you look at the headlines, plenty of organizations had solid endpoint detection and response capabilities and still became victims of ransomware.
With that said, what does your public sector agency need for a successful ransomware readiness approach? Here are 10 tactics you can use to ensure ransomware readiness:
1. Endpoint Protection, Detection, and Response. A solid endpoint detection and response platform is key to overall ransomware protection. Pattern and behavior-based approaches, balanced with signature-based protection, is a compelling blend for overall ransomware prevention. Many consider ransomware reaching the endpoint as “too late” but it is better to have the capability then not.
2. DNS Protection. Consider DNS protection as another layer of overall ransomware prevention. The malware is blocked from being downloaded if it is a known malicious website.
3. Secure Email. Many ransomware attacks begin with an email that either contains attached malware or a link to a location to download the malware. An email security solution scans for malicious attachments and strips them as well as protection from clicking on malicious links.
4. Secure Browsing. Malware that is detonated in a sandbox is unable to impact an endpoint. Secure browsing solutions isolate browsing sessions in a container or sandbox and only replays input, output, and video to the end user, preventing ransomware from ever reaching an endpoint.
5. Lateral Movement Prevention. When all else fails, keeping ransomware contained on a single endpoint is the goal. Ransomware is insidious and attempts to spread to as many systems and file shares as possible. Lateral movement prevention keeps malware from moving across the network to additional systems.
6. Least Privileged Architecture. Imagine an environment where people and systems only had enough access to perform a given task at a given time. This utopian compute approach is no longer science fiction, and many organizations are implementing just in time access control to prevent the spread of ransomware.
7. Data Governance. Who has access to what information? This question is key to preventing the spread of ransomware since if a limited number of users have write access to unstructured data, the malware essentially starves before it can do any real damage.
8. Secure Backup Strategy. In the unlikely event that ransomware impacts an organization after implementing the steps above, a sound secure backup strategy is essential for ransomware recovery. Backups should be secure, scanned, and contain an offline copy that is free from ransomware that targets backups.
9. Incident Response Plan. Often called the “Ransomware Response Playbook,” organizations need an incident response plan specific to a ransomware attack. The response plan should be kept “offline” to avoid having the file encrypted by the ransomware. It is suggested that as part of a ransomware readiness program, an organization keep a bitcoin bank at the ready in case a decision is made to pay the ransom.
10. Business Continuity Plan. How does an organization continue in the event of a ransomware infection? Having a well laid out recovery plan with local and federal law enforcement contacts is important to know what needs to be done to continue business.
Ransomware readiness is achievable for any public sector organization. Keep in mind that following the best practices outlined above will reduce the likelihood of breach, but with all things in cybersecurity, nothing is one hundred percent preventable.
With the statistics demonstrating that a compromise caused by ransomware is still possible, the most often asked question is “how do we return to normal?” The best way to return to normal is to make sure that any impacted systems or data are held for forensic analysis. A root cause analysis should be performed, and defenses need to be improved based on the findings. Once defenses are improved, data can be restored from a verified safe backup, and business can resume as normal.
About the Author
Brad Bussie is an award winning industry veteran with nearly two decades of experience in information security. He is an author, security strategist, and industry thought leader. He holds an undergraduate degree in information systems security and an MBA in technology management. Brad possesses premier certifications from multiple vendors, including the CISSP from ISC2. He has deep background in cybersecurity, identity/access management, vulnerability management, governance, risk, and compliance. Brad has spoken at industry events around the globe and has helped commercial, federal, intelligence, and DoD leaders solve complex security challenges.
