Ransomware's Real World Impacts: Corporate Fatality, School District Delays Start Date, Law Suit Against Attackers, and More

That size business (300 - 500 employees) often faces the toughest cybersecurity challenge - big enough to have fairly complex IT operations but too small to routinely staff IT and security teams with enough skilled people to achieve basic security hygiene. If you work at one of those companies and have been fighting that battle, this is a good case study to show management. The Center for Internet Security has a good starting point in a Small Midsize Enterprise guide to the Critical Security Controls found at https://www.cisecurity.org/white-papers/cis-controls-sme-guide/: CIS Controls SME Companion Guide

John Pescatore

As we have seen with other attacks, such as the attacks to NOLA and Baltimore, IT and business process recovery can take a long time. Further, recovery of necessary capital to continue to make payroll and other expenses can be even harder, particularly after the added expenditures associated with system recovery. In this case, both billing and payment processing capabilities were shut down, closing off the business income sources. Beyond purchasing cyber insurance, make sure to take a hard look at your business resumption plan and identify conditions which, if present, are fatal to the business and develop a plan accordingly. Clear communication about the nature and breadth of incidents can help employees make good decisions and build support around recovery efforts.

Lee Neely

This demonstrates that the risk of "ransomware" attacks is existential. This will not be the last enterprise to be destroyed by "ransomware." However, at this stage in the game, every enterprise should be aware and prepared. Preparations should include strong authentication, "least privilege" access control, end-to-end application layer encryption, "three" copies of mission critical data, on "two" kinds of media, at least "one" offsite, with a capability to recover critical applications in a timely manner.

William Hugh Murray

While the identities of the operator of the Maze ransomware remain unknown, and the outcome of that action is uncertain, the injunction against the hosting company resulted in taking down the site that hosted the stolen data. The question remains of will this be an effective way to recover this type of content or will this result in the content being moved to other providers or Tor which will be harder to take down.

Lee Neely

With 800 employees and just under $300M in revenue, Canyon is a good example of the higher end of small midsize enterprise space in the manufacturing space. If you work at a company with a similar profile, this is a good example to use to get across the direct connection between basic security hygiene and revenue - when products don't ship, revenue stops and competitors zoom forward.

John Pescatore

Make sure that your DR/COOP plans include objectives that support the company remaining both viable and competitive. Those plans may also need to include verified alternate business options to bridge the gap.

Lee Neely

While Iran has cyber offense capabilities, there is no indication as to what to expect when. The best thing to do now is report suspicious activities, ensure security personnel are monitoring for relevant IOCs and TTPs, exercise incident response plans, and make sure you take care of the basics, such as effective backups and multifactor authentication. The CISA.gov and DHS Hometown Security Campaign are good resources here: https://www.dhs.gov/cisa/hometown-security: Hometown Security

Lee Neely

It is never a bad idea to use current events to ramp up attention being paid to cybersecurity. However, physical attacks are more often met with physical retaliation. Good idea to make sure your mail room is alert for suspicious packages - US Postal Service Publication 166 is a good set of guidelines at https://about.usps.com/publications/pub166.pdf: Who Protects Your Mail? (PDF)

John Pescatore

The same pervasive vulnerabilities that are being exploited in "ransomware" attacks can be exploited in "wiper" attacks by nation states in times of hostility. The problem of attribution of these attacks makes them particularly attractive.

William Hugh Murray

As a general rule, it is more important to patch thoroughly than urgently. That said, patches to infrastructure should get priority.

William Hugh Murray

Travelex was hit by REvil/Sodinokibi Ransomware and the current demand is $3 million. The compromise appears to be the result of exploiting the Critical Pulse Secure VPN vulnerability (CVE-2019-11510); highlighting the importance of patching services which provide or control access to your network. The exfiltrated data includes dates of birth, social security numbers and card numbers, and as Sodinokibi says they will publish it if not paid; if you are (or were) a Travelex customer, verifying that you have active credit monitoring, including any Travelex issued cards, would be prudent.

Lee Neely

Out-of-band confirmation of all payment mechanisms, no longer just wire transfers, is essential for both establishment of and changes to payment methods. Even legitimate communications can include transcription errors that can be corrected prior to failed or misdirected payments.

Lee Neely

Not a bad idea to scan for and remove this extension if detected. Also, relative to the use of cryptocurrency wallets on corporate computers: users right to privacy, or lack thereof, and corporate liability, particularly for security, needs to be carefully considered.

Lee Neely

While the blockchain on which cryptocurrency is based is secure, the wallets and exchanges are so vulnerable as to put the whole scheme at risk.

William Hugh Murray

"Card not present" fraud is now the preferred way to compromise and monetize credit and debit card numbers. Only a small number of merchants can provide the necessary security required to process credit or debit card account numbers safely. Online merchants must employ checkout proxies like PayPal and Apple Pay and must not accept, process, or store credit or debit card numbers in the clear. Consumers who deal with merchants that require credit or debit card numbers should use one-time or one merchant card numbers like those provided by privacy.com.

William Hugh Murray