• Search for:
    10Oct, 2022
    The Harsh Truths of Cybersecurity in 2022, Part II

    Sonya Duffin, ransomware and data-protection expert at Veritas Technologies, shares three steps organizations can take today to reduce cyberattack fallout.

    In part one of this series, I outlined some harsh truths of cybersecurity in 2022 and the first three of the top six steps you should take to ensure resiliency against today’s most pervasive threat—ransomware. Here, I’ll cover the remaining three:

    But first, let’s take a quick step back.

    It used to be that ransomware would get into a system, start encrypting and downloading as much as it could, and then escape before it was detected. But ransomware and the cybercriminals behind it have now evolved.

    Mimicking the art of “casing the joint,” they get in, do cyber-reconnaissance, lurk until the optimal time to inflict maximum impact, and then they strike. This practice of remaining undetected for a period of time is often referred to as dormant ransomware, and it is now a regular occurrence.

    Bad actors are highly motivated to cause as much destruction as possible to make more money and maximize their efforts — just as with any business, it’s all about ROI. Some reports suggest that ransomware sometimes lays dormant for up to 18 months. The bad actors know that optimal destruction depends on multiple factors, such as timing and scope. They want you to have no other choice but to pay the ransom.

    In short, the old days of a breach and attack happening at the same time are long gone. This added complexity means that cybercriminals often know your systems better than even you do. Therefore, the chance that they launch a series of events designed to disrupt and disable critical systems to net larger payouts is rising drastically.

    So, what should you do today to combat this new dormant ransomware and cyber-recon strategy? In the first part of this series, I discussed:

    • Get Full Infrastructure Awareness
    • Automate Alerts for Anomalous Behavior
    • Limit Access & Reduce Your Attack Surface

    Without further ado, here are the remaining three of the top six steps to ensure ransomware resiliency.

    Make Resiliency & Rapid Recovery Your Goal

    With the mindset that bad actors are already in your system, resiliency and rapid recovery should become the ultimate goal. We are talking about so much more than just a restore point, a single backup copy or making multiple copies. You must architect an optimized and simplified recovery experience that will help you get back up and running quickly, even at scale.

    Truly optimizing for the recovery experience requires careful planning, orchestration, recovery options, cross-functional alignment and training, storage deduplication efficiencies, and global visibility and oversight. Having solutions that provide recovery from anywhere to anywhere, and flexibility and choice in the event of an attack or disaster, is critical.

    Why? Well, cyberattacks are never one size fits all. Sometimes everything is impacted and you may need to recover an entire data center in the cloud and on demand. On the other hand, maybe not all your environment is impacted, just a portion; having solutions in place that allow you to grab individual databases and files to recover back quickly into production can be vital. In the case where entire servers become encrypted, you may need to quickly recover those entire servers elsewhere. Or maybe you just need to recover a large amount of virtual machines back to production.

    Important reminder: Not all tools provide this level of flexibility. It is important to think through all of the scenarios and choose the right solution. And remember, multiple disparate backup solutions create a complicated recovery experience, especially when multiple systems are compromised. Simplify and streamline by reducing the number and variety of point products and vendors across your organization.

    Use Immutable & Indelible Storage to Keep Backups Safe

    I recommend the 3-2-1+1 methodology of data backup. That means at least three copies of your data on at least two distinct mediums with at least one offsite or segregated — and, have at least one of those copies on immutable and indelible storage.You can implement technology to help you easily and automatically execute a 3-2-1+1 methodology that ensures no single point of failure, by configuring lifecycle policies that send data over to a secondary or even tertiary domain. Look for technology that can send your data unidirectionally to a secure second location that can have different credentials configured and limited network capabilities, ensuring proper segmentation of your data protection environment. Even better are tools that can also send a copy of de-duplicated immutably stored data to the cloud.

    Important reminder: Immutable and indelible storage helps ensure that your data cannot be changed, encrypted or deleted for a determined length of time, or at all. At first, make immutable storage your second copy, but once you get comfortable with your retention policies, make it your primary copy.

    Rehearse Your Recovery

    Cybercriminals hope that your organization is like most — not optimized for recovery. They want maximum damage and downtime to ensure they get paid. If you are ready and have rehearsed your recovery, you are a huge step ahead.

    To get to rapid recovery, you must have a cybersecurity response plan for your entire environment that includes testing early and often. Yes, regular rehearsals of your recovery help to limit downtime and disruptions and reduce the impact of an attack. Look for technology that makes it easy and efficient to execute non-disruptive tests leveraging non-production resources such as fenced networks and sandbox environments.

    Also, rehearse recovering everything, and not just a subset of your applications, including things like your domain, authentication, system time and other infrastructure services, as you will likely be recovering most or all of your production environment in the event of an actual attack.

    Important reminder: Regular rehearsal and validation are vital for success because when you are in crisis mode, things just need to work.

    In closing, one final harsh truth: It will get worse. Cybercriminals are sophisticated, well-funded and here to stay. Ransomware-as-a-service vendors exist in large numbers and have successfully transitioned to a highly profitable business model with the charter of successfully crippling organizations at their most vulnerable times to maximize ransoms. These businesses provide turnkey code, have advanced support networks with helplines, and provide tools for encryption, communicating with victims and facilitating ransom collection.

    In addition to the dormant ransomware trend, we have already seen a vast influx of zero-day attacks in 2022. Along with patching and updating software regularly, it is also important to prioritize educating your employees across your entire organization. Zero-day attacks often capitalize on human error.

    The good news is that you can be one step ahead of cybercriminals with the proactive steps outlined in this two-part series, diligence and some creative thinking.

    Resource : https://threatpost.com/harsh-truths-cybersecurity-part-two/178447/

    10Oct, 2022
    3 Tips for Facing the Harsh Truths of Cybersecurity in 2022, Part I

    Sonya Duffin, ransomware and data-protection expert at Veritas Technologies, shares three steps organizations can take today to reduce cyberattack fallout.

    Be forewarned—I’m about to lay down some harsh truths here.

    First, ransomware is prevalent, and there is no way to completely eliminate the threat.

    Second, at this point, you should operate under the assumption that hackers are already in your systems or could easily access them at any moment. It should come as no surprise when I tell you that the sophisticated cybercriminals behind today’s ransomware threats have been consistently getting past even the best frontline security — and for a while now.

    Third, cybercriminals may know your systems and infrastructure better than you do. Once in, their strategy is to lay low and remain hidden while they learn as much as they can. Then they strike at the optimal time to inflict as much damage as possible to ensure a hefty payday.

    So now what?

    The good news is that there are practices and technologies that can help you detect threats before the bad actors can take action. There are also strategies that you can use to reduce your attack surface while preventing large-scale disruption and disablement once they are inside your environment.

    With that in mind, this two-part series will outline the top six steps you should take right away to ensure resiliency in the face of this ever-present threat. Let’s begin with the first three.

    Get Full Infrastructure Awareness

    Attackers are looking for your weakest links, and the dark corners where there may be limited security and oversight in your environment. So, it’s vital to implement tools that provide full infrastructure awareness by shining a light on all the dark data in your environment. According to the recently published Veritas Vulnerability Lag research (PDF here), 35 percent of data is still dark. That is alarmingly high. Get to work on knowing what data you have and where it is ASAP.

    Important reminder: In addition to full visibility of everything in your environment, it is also vital to have clear hard-copy documentation on the details of your environment, like procedures and configurations—including IP addresses, passwords etc.—to help aid with recovery. Missing these details can keep you and your team from being able to quickly recover in the chaos of an attack. Store these in a safe that is checked and updated regularly.

    Automate Alerts for Anomalous Behavior

    Implement tools that can provide you with detection of anomalous behaviors or activities associated with both data and user activity across your entire environment. It’s important that the detection capabilities can run autonomously, without the need for manual steps.

    Alerting your teams to anything anomalous or out of the ordinary will provide you with the upper hand, and a chance to act before the cybercriminals or a malicious code attack. This could be things like unusual file-write activity that could indicate an infiltration, but it could also be detecting known ransomware file extensions, file access patterns, traffic patterns, code downloads, access requests, storage capacity surges, external traffic paths or even an unusual jump in activity compared to individuals’ typical patterns.

    For example, in the infamous SolarWinds hack, hackers used a regular software update to slip some elegant and innovative malicious code into a multitude of companies’ networks, using the SolarWinds software.

    For more than nine months they roamed around high-profile and sensitive companies, hiding in plain sight while learning their systems and gathering intelligence. Their mistake came when they started roaming around the cybersecurity company FireEye.

    The security team at FireEye noticed suspicious activity — someone trying to register a second phone onto the company network. Finding it odd that an employee would have two phones, they jumped into action and called the user. Surprise! That user did not register that phone and had no idea who did. Thanks to the vigilance of FireEye, which investigated out-of-the-ordinary activity, the broader intrusions came to light.

    Important reminder: Conduct cyber-threat hunts regularly. Take it seriously and implement protocols for investigating anomalous behaviors. Hire a third-party agency to audit your strategy, check your work and find vulnerabilities.

    Limit Access & Reduce Your Attack Surface

    After sneaking into your environment, cybercriminals often search for confidential information or login credentials that will allow them to move laterally across your environment. This means that they can also gain access to your backup systems and will attempt to eliminate recovery options.

    There are a few things that you can do to help mitigate this practice:

    1. For starters, limit what and where each set of credentials can operate, and have different passwords for every domain.
    2. Make sure that there is not one god-admin that can do everything.
    3. It is also important to lock down or limit executives’ access, as they are often easy targets.
    4. Just as important, limit admin access and privileges, especially to backups.
    5. Another common practice is to implement zero-trust approaches with multifactor authentication (MFA) and role-based access controls.
    6. Also vital is to segment or microsegment your network into multiple zones of smaller networks and ensure access is managed and limited, especially to your most crucial data.
    7. Many organizations are also moving towards a just-in-time security practice where access is granted on an as-needed basis or for a predetermined period of time, which is something to consider for crucial and business-critical data.

    By building a variety of barriers, bad actors will be contained and prevented from moving around your environments. They are essentially stopped in their tracks. So, get creative—meaning, set up a system unique to your needs and security requirements.

    When the Metropolitan Transportation Authority of New York was hacked last April, attackers did not gain any access to systems that control train cars nor was any customer information compromised. Why? Because they have a multilayered, segmented network of more than 18 different systems, only three of which were compromised. Thanks to this great system, the threat actors were prevented from moving throughout the system, the event was isolated and systems were restored quickly.

    Important reminder: Create a walled-off network that looks exactly like your production network, but with different management credentials. Share nothing with your production networks except access to immutable storage. You can use this space to recover your data and services and scrub your data of malware. It is also a great place to test recovery.

    Stay tuned for part two in this series, where I’ll cover the remaining three of the top six steps you should take today to ensure ransomware resiliency in today’s rapidly evolving cybersecurity landscape.

    Resource : https://threatpost.com/harsh-truths-cybersecurity-tips/178311/