Protecting Against Ransomware – From the Human Perspective

As a security awareness officer, you and your organization are most likely very concerned about ransomware but may not be sure where to start. How do you secure your workforce and protect against ransomware without overwhelming or confusing them with lots of new information? In this overview we explain what ransomware is, how it works, and most importantly, how to empower your workforce to protect against it with three simple steps. For a more technical and comprehensive framework on managing the risk of ransomware I highly recommend the NIST Ransomware Risk Management publication.

What is Ransomware? 

Simply put, ransomware is a type of malware used by cyber criminals to make money, a lot of money. Malware, which stands for malicious software, are programs that enable cyber criminals to take over a computer or device once it is infected. Once infected, there are numerous ways cyber criminals can leverage the victim’s system for profit, such as collecting credit card data which they then sell, harvesting logins and passwords to people’s bank accounts which they use to steal and transfer money, finding personal information which they leverage for identity fraud, or connect the victim’s computer into a botnet for attacks such as Distributed Denial of Service (DDoS) attacks. The challenge with each of these methods is that they require a great deal of work on the criminal’s part to monetize the system(s) once infected.

Ransomware revolutionized the cyber criminal world as it made it simpler and far more profitable to monetize infected systems. Instead of spending weeks or months harvesting individual bank accounts or collecting credit cards which they could sell for hundreds of thousands of dollars, ransomware enables cyber criminals to infect a single organization and within days, make millions of dollars. The reason we have seen an explosion in ransomware attacks is two-fold.

• Ransomware has proven to be one of the fastest and most profitable way for cyber criminals to monetize malware infections, exponentially more profitable than almost any other attack. As such, cyber criminals are investing more and more in ransomware attacks, it is where the Return on Investment (ROI) is.
• When an organization is infected with ransomware, it is often very public, so you hear about the incident in the news (as opposed to attacks such CEO fraud, which you almost never hear about as they are kept quiet).

How Does Ransomware Work?

As we have already covered, ransomware is simply another type of malware. The first step for malware to work is infecting the victim (which we cover in more detail below). Today, most cyber-criminals do not target individuals with ransomware, instead it’s far more profitable to infect entire organizations as the ROI is magnitudes larger. In general, ransomware monetizes infections in one of two ways.

1. Once infected, the cyber criminals encrypt numerous computers, systems, or backups denying an organization the ability to access their most important data and shutting down their ability to operate. Cyber criminals then demand a ransom to be paid, in return they will provide a decryption key so the victim organization can access their data and return to operations. These attacks can be especially crippling for industries such as healthcare, manufacturing or utilities, where recovering from backups would take too long.
2. Once infected, the cyber criminals exfiltrate the organization’s sensitive information and then threaten to publicly release the data if the ransom is not paid. If the information is publicly released, the incident can damage the victim organization’s reputation, expose them to numerous lawsuits, and put them at risk for violating key compliance requirements such as GDPR.

In today’s world, many cyber criminals do both types of ransomware attacks at the same time, forcing the victim organization to pay as soon as possible. In addition, cyber criminals have become very sophisticated in how they operate. Once cyber criminals infect a single computer in an organization, they do not immediately demand a ransom. Instead, they use that infected system to stealthily infect other computers in the organization, perhaps even the backups. Not until the cyber criminals believe almost every system has been infected, and not until they have exfiltrated an extensive amount of data will they then enable the ransomware, encrypt all the devices, and notify the organization. This ensures the maximum impact possible to the victim. In some cases, cyber criminals go so far as to infiltrate and recover financial and insurance information to learn just how much money the victim company has made this year or how much their insurance pays for ransomware, ensuring the cyber criminals can demand the maximum amount of payment possible.

How Do We Stop Ransomware?

The way to stop ransomware is the same way you would protect against almost any other type of malware;  focus on not getting infected. From a security awareness perspective, there is little difference. As such, we recommend you focus on training and stopping the most common ways people / organizations get infected. Be warned, people often have the misconception that if they have anti-virus installed then their computers are secure and cannot be infected. Unfortunately, that is not the case. In today’s highly organized cyber-criminal world, there are entire organizations dedicated to continually developing malware that cannot be detected. As such, a key lesson you will have to teach is that anti-virus alone is not enough, their behaviors are key to protecting against malware.

The top three lessons you want to focus on for ransomware are

1. Social Engineering: These types of attacks, especially phishing, are one of the primary methods cyber attackers use to infect systems. Train people on how to spot and stop phishing attacks.
2. Passwords: Weak or insecure passwords are another very common way cyber attackers break into organizations today. Provide the training and tools to ensure people are using strong passwords.
3. Updating: Updated and current systems are much harder for cyber attackers to infect with malware. We want to ensure people are always using the most current operating systems and applications. In some cases, you may want to emphasize the importance of enabling automatic updating.

In addition, make sure you train your workforce on how to report a suspected infected computer. Ensure they feel comfortable reporting, even if they know they caused the infection. If your organization has a punitive or toxic security culture, people may be hesitant or even afraid to report they caused an infected system, so ensure they feel comfortable reporting.

SANS Security Awareness offers globally relevant, expert authored tools and training to enable organizations to shield their workforce from attacks and a fleet of savvy guides and resources to work with you every step of the way. Learn more here!