Effective Ransomware Response is Not as Complicated as You Might Think

June 13, 2022

Compared to other types of cyberattacks, ransomware is practically a walk in the park.

Preparation is key to managing information security risks. Well-prepared enterprises with detailed incident response playbooks can shrug off cyberattacks that paralyze other organizations.

Ransomware is an excellent example.

Ransomware attacks have made headlines due to the eye-watering sums cybercrime syndicates started to ask for in recent years. Before the pandemic, six-figure ransoms were rare. Now they are commonplace, and some criminals are bold enough to demand seven-figure sums to decrypt their victim’s files!

There’s a good reason why this is happening, however. All markets – even illicit ones – follow the same economic laws of supply and demand.

The fact is that many enterprise cybersecurity professionals are now equipped to handle ransomware attacks. The “supply” of victims is dwindling, so the price each victim pays must rise.

Media headlines don’t tell you how many enterprises successfully mitigate ransomware attacks without paying. Cybersecurity bloggers don’t often mention how easy it is to thwart a ransomware attack – if you’re sufficiently prepared for it.

Mitigating Ransomware Risk Is All About Preparation

It’s true that ransomware attacks can be devastating. Very few organizations can afford to lose tens of millions of dollars without disrupting their business. In some cases, those losses and their after-effects can force the organization to shutter its doors entirely.

But that doesn’t mean ransomware is unavoidable. In fact, it’s one of the most preventable types of cyberattacks there is.

But there is a caveat – Stopping ransomware attacks requires preparing for them well in advance.

Your organization needs a robust disaster recovery system, with high-fidelity backups made through a secure connection. If you take the time to set this up and test it thoroughly, you can simply run your entire business system off your non-infected backup system and go about your day.

For information security professionals, there are few things more satisfying than dismissing multi-million-dollar ransom demands as a trifling nuisance. Efficient, high-performance disaster recovery solutions allow you to do just that.

Of course, your disaster recovery solution must be powerful enough to meet the challenge. Depending on how well-segmented your network architecture is, you may need to run several business units off it for days or weeks at a time. It will take an in-depth investigation to clear your primary systems for daily operations.

It’s worth mentioning that this is the same disaster recovery solution you might use to counter the effects of a flood or a power outage. Cybersecurity risk management is enterprise risk management. The better prepared you are to handle unexpected events, the more successful your response will be.

There are Much More Challenging Cybersecurity Risks Than Ransomware Out There

Ransomware might not deserve the level of media attention it gets compared to other types of attacks. Compromised credentials and malicious insiders rarely make national headlines, but they present a far more challenging risk to enterprise security professionals.

The more complicated threat:

Malicious Insiders: How to Defend Against Invisible Threats

Even the most comprehensive backups can’t mitigate the actions of a malicious insider. If someone is abusing company credentials to grant themselves admin privileges, they may simply disable backups if they choose. They may create false invoices and wire themselves money at company expense. In short, they can do practically anything and get away with it.

Identifying this behavior is beyond the capability of most first-generation security information and event management systems. SIEM 1.0 technology focuses largely on detecting external threats and pays little attention to what valid, authenticated users are doing.

But even these types of attacks are preventable. Next-generation SIEM platforms like Exabeam use User Entity and Behavioral Analytics (UEBA) to continuously validate the activities of authenticated users. When a user starts deviating from their established activity baseline, it triggers a series of increasingly critical alerts, giving analysts time to investigate the threat and decisively respond.

Leverage Castra Expertise to Gain Peace of Mind

At Castra, we don’t buy into the doom and gloom narrative the rest of the industry fixates on. We don’t believe there is anything “inevitable” about cybercrime, and we have the experience to support it.