10 Ransomware Prevention and Recovery Tips

The new head of the FBI’s San Antonio office stated that ransomware attacks in particular have skyrocketed as more of us work and go to school from home. And when it comes to ransomware, the FBI focuses on critical infrastructure: anything that involves national security or the economy.

“We don't advise companies to pay ransoms,” Rich says. “However, even if they do, we still ask them to let us know what's happening because if they report it to us, and report it to us early, we can help identify who the threat actor is.”

10 Ransomware Prevention and Recovery Tips 

Quick steps you can take now to PROTECT yourself from the threat of ransomware:

1. Use antivirus software at all times
Set your software to automatically scan emails and flash drives.

2. Keep your system patched and up to date 
Run scheduled checks to keep everything up-to-date.

3. Block access to the ransomware site
Use security products or services that block access to known ransomware sites.

4. Restrict Application
Configure operating systems or use third-party software to allow only authorized applications on computers.

5. Restrict personally owned devices on work networks
Organizations should restrict or prohibit access to official networks from personally-owned devices.

6. Restricting Administrative Privileges
Use standard user accounts vs. accounts with administrative privileges whenever possible.

7. Avoid using personal applications
Avoid using personal applications and websites – like email, chat, and social media – from work computers.

8.  Beware of Unknown sources 
Don't open files or click on links from unknown sources unless you first run an antivirus scan or look at links carefully.

Ransomware Readiness Recovery Tip

Steps you can take now to help you RECOVER from a future ransomware attack:

9. Have an Incident Response Plan

Develop and implement an incident recovery plan with defined roles and strategies for decision making. 2 Carefully plan, implement, and test a data backup and restoration strategy – and secure and isolate backups of important data. Have a team of incident response professionals on retainer to quickly respond in the event of a breach. 

10. Have Backup & Restore capability

Create a business continuity plan, and maintain an up-to-date list of internal and external contacts for ransomware attacks, including law enforcement.

• Recovery Strategies

• Business impact analysis

There is a lot more not covered in this article like incident response tabletop exercise, ransomware negotiation, and ransomware payment.

What is Cyber Security, IT Security, and Data Security?

What is the need for IT security and CyberSecurity?

Computer security, cybersecurity or information technology security (IT security) is the protection of computer systems and networks from the theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide.

IT security is a set of cybersecurity strategies that prevents unauthorized access to organizational assets such as computers, networks, and data. It maintains the integrity and confidentiality of sensitive information, blocking the access of sophisticated hackers.

What is Data Security?

Data security means protecting digital data, such as those in a database, from destructive tampering and unauthorized access. Hardware based security or assisted computer security offers an alternative to software-only computer security.

Common examples of:

• Data encryption
• Tokenization
• Key management
• Data loss prevention
• Data classification
• Data accees management

What is the need for network security?

Network security is the practice of securing a computer network from intruders, whether targeted attackers or opportunistic malware. Application security focuses on keeping software and devices free of threats. A compromised application could provide access to the data its designed to protect.

What is Internet security

Internet security involves the protection of information that is sent and received in browsers, as well as network security involving web-based applications. These protections are designed to monitor incoming internet traffic for malware as well as unwanted traffic. This protection may come in the form of firewalls, antimalware, and antispyware.

What is Critical infrastructure security:

Critical infrastructure security consists of the cyber-physical systems that modern societies rely on.

Common examples of critical infrastructure:

• Electricity grid
• Water purification
• Traffic lights
• Shopping centers
• Hospitals

What is Application security:

You should choose application security as one of the several must-have security measures adopted to protect your systems. Application security uses software and hardware methods to tackle external threats that can arise in the development stage of an application.

Applications are much more accessible over networks, causing the adoption of security measures during the development phase to be an imperative phase of the project.

Types of application security:

• Software development
• Application testing
• Code review
• Vunerablity and penetration testing

What is Network security:

Network security ensures that internal networks are secure by protecting the infrastructure and inhibiting access to it.

Common examples of network security implementation:

• Extra logins
• New passwords
• Application security
• Antivirus programs
• Antispyware software
• Encryption
• Firewalls
• Monitored internet access

Types of cyber threats:

The threats countered by cyber-security are three-fold:

1. Cybercrime includes single actors or groups targeting systems for financial gain or to cause disruption.

2. Cyber-attack often involves politically motivated information gathering.

3. Cyberterrorism is intended to undermine electronic systems to cause panic or fear.

So, how do malicious actors gain control of computer systems? Here are some common methods used to threaten cyber-security:

Malware

Malware means malicious software. One of the most common cyber threats, malware is software that a cybercriminal or hacker has created to disrupt or damage a legitimate user’s computer. Often spread via an unsolicited email attachment or legitimate-looking download, malware may be used by cybercriminals to make money or in politically motivated cyber-attacks.

There are a number of different types of malware, including:

• Virus: A self-replicating program that attaches itself to clean file and spreads throughout a computer system, infecting files with malicious code.

• Trojans: A type of malware that is disguised as legitimate software. Cybercriminals trick users into uploading Trojans onto their computer where they cause damage or collect data.

• Spyware: A program that secretly records what a user does, so that cybercriminals can make use of this information. For example, spyware could capture credit card details.

• Ransomware: Malware which locks down a user’s files and data, with the threat of erasing it unless a ransom is paid.

• Adware: Advertising software which can be used to spread malware.

• Botnets:Networks of malware infected computers which cybercriminals use to perform tasks online without the user’s permission.

SQL injection

An SQL (structured language query) injection is a type of cyber-attack used to take control of and steal data from a database. Cybercriminals exploit vulnerabilities in data-driven applications to insert malicious code into a databased via a malicious SQL statement. This gives them access to the sensitive information contained in the database.

Phishing

Phishing is when cybercriminals target victims with emails that appear to be from a legitimate company asking for sensitive information. Phishing attacks are often used to dupe people into handing over credit card data and other personal information.

Man-in-the-middle attack

A man-in-the-middle attack is a type of cyber threat where a cybercriminal intercepts communication between two individuals in order to steal data. For example, on an unsecure WiFi network, an attacker could intercept data being passed from the victim’s device and the network.

Denial-of-service attack

A denial-of-service attack is where cybercriminals prevent a computer system from fulfilling legitimate requests by overwhelming the networks and servers with traffic. This renders the system unusable, preventing an organization from carrying out vital functions.

8 Cyber Security Best Practices for Business

1. Conduct Phishing Simulations
2. Implement Risk Management Governance Approach
3. Secure Remotely Working and Travelling Employees
   • Plan for mobile devices
4. Create a Cybersecurity Awareness Training Program
5. Monitor User and File Activity
6. Enforce password best practices
7. Enforce the Use of Password Managers, SSOs, and MFAs
8. Audit Privileged Access
9. Implement Data Loss Prevention
10. Update Software and Systems
11. Implement and monitor EDR, MDR, and SIEM
12. Regularly back up all data, and offsite backup

CyberSecOp cybersecurity solution provide pace of mind when it comes to privacy and security. Ensuring data security in the cloud or onpfremisies , compliant and protected by best-in-class security: your data, and the tools you use to harness it, can truly empower your business.

COVID-19 Prompts Increased Ransomware Attacks Against SMBs Healthcare Providers

With the inception of the COVID-19 pandemic, malicious actors are increasingly targeting small hospitals and health centers with ransomware attacks. This is likely because these organizations are more likely to pay the ransom to recover data, as they weigh the perceived cost/benefit to strengthening their IT infrastructure security, or moving part or all of their IT operations to cloud-based solutions.

Cybercriminals tend to specifically target direct patient care facilities such as hospitals, healthcare centers, medical practices and health and wellness centers; although their efforts are certainly not confined to the above-referenced provider classes. The average ransomware demand is in the neighborhood of $60,000; however, simply paying the ransom in no way guarantees that the attacker will remit the decryption key; in fact, quite the opposite may occur; paying a ransom may encourage the attacker to maintain the leverage they enjoy over the target. 

The ultimate consequences of ransomware attacks can and often are quite severe, ranging from continued involuntary exploitation of the attacker/victim relationship, to business closure. In some cases, class action lawsuits (dependent on the attack vector and information yield).

As more organizations move employees to work from home, remote staff make it increasingly difficult for IT teams to police computer systems and prevent cyber-attacks. Attackers now have far more access points and endpoints to probe or exploit, with little to no security oversight.

Here at CyberSecOp, we have formulated several countermeasures that healthcare employers should employ to minimize the risk of their networks being penetrated and secure their sensitive information.

Add data storage: After backing up data, the next step is to store data offline, on a different network, or a cloud-based environment.

Maintain a strong information encryption policy: Healthcare data must be encrypted at rest and transit with the highest standards available so that even if cybercriminals acquired it, they would not be able to read it.

Formulate and maintain an Incident Response Plan: Develop and test an incident response plan to help mitigate the impact of certain destructive malware attacks.

Track all data: Security personnel should closely monitor the company’s digital assets within the organization. This is of particular importance now as healthcare facilities’ attack surface expands and becomes more complex with some staff working remotely. 

Establish and maintain firewalls: To harden networks and connected equipment, healthcare facilities with devices running open services should place them behind the latest application firewalls. They should also implement proper change management and firewall reviews to ensure proper documentation and optimization of these devices.

Follow the trends: Be aware of current ransomware threats, attack trends, and make sure those trends are socialized and communicated throughout the organization. Awareness is key.

9 Most Important Cyber Security Tips

Teleworking during the Coronavirus outbreak? While working from home can help slow the spread of the virus, it brings new challenges: juggling work while kids are home from school; learning new software and conferencing programs; and managing paper files at home. As you’re getting your work-at-home systems set up, here are some tips for protecting your devices and personal information.

The internet has become a space riddled with malicious links of trojans, and viruses. Data breaches are becoming more frequent, and unsuspecting users are more vulnerable than ever before. 

1. Start with cybersecurity basics. Keep your security software up to date. Use passwords on all your devices and apps. Make sure the passwords are long, strong and unique: at least 12 characters that are a mix of numbers, symbols and capital and lowercase letters.

2. Connect Only to Protected Private WiFi Networks or (VPN) Virtual Private Networks

Always use private, password-protected WiFi networks to work from home. Security experts consider signing in to sensitive office networks with public WiFi or unsecured network connections akin to “swimming in shark-infested waters”—it’s only a matter of time before you get bit. Experts recommend consulting a trusted IT provider about setting up a VPN that can minimize the risk to devices and data.

3. Dispose of sensitive data securely. Don’t just throw it in the trash or recycling bin. Shred it. Paperwork you no longer need can be treasure to identity thieves if it includes personal information about customers or employees.

4. Unusual phrasings in subject lines/body, misspellings, or bad grammar

Although corona-virus-related phishing schemes are currently at an all-time high, the good news is that they aren’t much different from past attempts. Paying extra attention to message details—capitalization, punctuation, paragraph structure, sloppy design/formatting, or any language that seems out of the norm, makes detecting fake ones easier.

5. Don’t download unfamiliar attachments or click on unfamiliar links

In the age of remote work, collaborative OneDrive, Google Docs, or general Cloud sharing is a common way to redirect others to a malicious website. If you aren’t expecting a specific file from a specific sender, don’t open any attachments in an unknown message. This applies to links as well. To check if a link is safe, hover your mouse over the link to confirm the target URL matches what’s written (on a desktop or laptop). For extra precaution, type out the website to avoid being unknowingly redirected.

6. Activate multi-factor authentication (MFA) on every account you can

Many phishing schemes try to get you to re-enter your password for common apps or social media accounts—all in hopes that hackers can steal your password. Using multi-factor authentication can mitigate this since MFA requires something you know (your password) with something you have (a unique code delivered via text message or email).

7. Confirm the sender's email address

It’s easy for a hacker to mimic someone’s display or contact name—always double check to confirm what shows up with the actual email address the message was sent from to make sure the sender is who he or she is claiming to be.

8. Do not respond to email correspondence from any financial institution

This goes for any communications via email or phone. You will not be prompted to sign into your account or receive a call from your financial institution asking for your PIN or other personal information. In fact, most updates are sent with a 'do-not reply' email handle. Most official communications from financial firms are usually sent via snail mail. To ensure you are in contact with an actual representative of the firm, call the number on the back of your card or the phone number provided on your financial statements.

9. Follow your employer’s security practices. Your home is now an extension of your office. So, follow the protocols that your employer has implemented.