Business in Big Trouble

August 13, 2020 | by morwebadmin

Here’s an article on how hackers used a phishing attack on a food & drink manufacturing firm and took advantage of a number of vulnerabilities like old hardware and default passwords and, tried extorting a fee from the victim to restore the network.

https://www.zdnet.com/article/ransomware-how-clicking-on-one-phishing-email-left-awhole-business-in-big-trouble/

Steps you should take to bolster your defenses:

1. MAKE SURE YOUR ANTIVIRUS SOFTWARE IS UP TO DATE

This seems obvious but, is occasionally neglected by smaller organizations. Many antivirus packages now offer ransomware-spotting features or add-ons that try to spot the suspicious behavior that's common to all ransomware. These apps monitor your files for unexpected behavior and aim to prevent it.

2. UNDERSTAND WHAT'S HAPPENING ACROSS THE NETWORK

There's an array of related security tools that can give you an insight into the traffic on your network. These products can give you an up-to-date view of your network and, should help you spot the sort of traffic anomalies that might suggest you've been breached by hackers. If you can't see what's happening on the network, there's no way you can stop an attack.

3. SCAN AND FILTER EMAILS BEFORE THEY REACH YOUR USERS

The easiest way to stop staff clicking on a ransomware link in an email is for the email never to arrive in their inbox. This means using content scanning and email filtering, which ought to take care of many phishing and ransomware scams before they actually reach staff.

4. HAVE A PLAN FOR HOW TO RESPOND TO A RANSOMWARE ATTACK, AND TEST IT

A recovery plan that covers all types of tech disaster should be a standard part of business planning, and should include a ransomware response. That's not just the technical response -- cleaning the PCs and reinstalling data from backups -- but also the broader business response that might be needed. Things to consider include how to explain the situation to customers, suppliers and the press. Consider whether regulators need to be notified, or if you should call in police or insurers. Having a document is not enough: you also need to test out the assumptions you have made, because some of them will be wrong.

5. THINK VERY LONG AND HARD BEFORE YOU PAY A RANSOM

Firstly, there's no guarantee that the criminals will hand over the encryption key when you pay up -- they are crooks, after all. If your organization is seen to be willing to pay, that will probably encourage more attacks, either by the same group or others. There's also the broader impact to consider. Paying a ransom, either from your own funds or via cyber insurance, is to reward these gangs for their behavior. It will mean that they are even better funded and able to run even more sophisticated campaigns against you or other organizations. It might save you some pain in the short term, but paying the ransom only fuels the ransomware epidemic.

6. UNDERSTAND WHAT YOUR MOST IMPORTANT DATA IS AND CREATE AN EFFECTIVE BACKUP STRATEGY

In the event that ransomware does compromise some devices, having a recent backup means you can restore that data and be operational again fast.

7. UNDERSTAND WHAT'S CONNECTED TO YOUR NETWORK

PCs and servers might be where your data resides, but they aren't the only devices you have to worry about. Thanks to the office wi-fi, the Internet of Things and working from home, there's now a wide variety of devices connecting to the company network, many of which will lack the kind of built-in security you'd expect from a corporate device. The more devices, the greater the risk that one will offer hackers a backdoor into your network, and then use that access to move through your systems to more lucrative targets than a badly secured printer or a smart vending machine.

8. MAKE IT HARDER TO ROAM ACROSS YOUR NETWORKS

Limit and secure the number of administrator accounts

9. TRAIN STAFF TO RECOGNIZE SUSPICIOUS EMAILS

Basic rule - don't open emails from senders you don't recognize. And don't click on the links in an email if you aren't absolutely sure it is legitimate. Avoid attachments whenever possible and beware of attachments that ask you to enable macros, as this is a classic route to a malware infection. Consider using two-factor authentication as an additional layer of security.

10. CHANGE DEFAULT PASSWORDS ACROSS ALL ACCESS POINTS

Clicking on a bad link in an email is probably the best known way of getting infected with malware, but it's far from the only way. Nearly a third of ransomware was distributed via brute force, according to research by F-Secure. Brute force attacks are attempts by hackers to access servers and other devices by trying as many passwords as possible, usually with the aid of bots, in the hopes of hitting the jackpot.

11. APPLY SOFTWARE PATCHES TO KEEP SYSTEMS UP TO DATE

Patching software flaws is a painful, time-consuming and tedious job. It's also vital to your security. Malware gangs will seize on any software vulnerabilities and attempt to use them as a way into networks before businesses have had time to test and deploy patches.