The latest statistics around ransomware attacks will only confirm your worst fears. In Sophos’ The State of Ransomware 2022 report, 66 percent of the 5,600 IT pros in 31 countries surveyed said they had been hit by ransomware last year. It gets worse: in 65 percent of those attacks, the organization’s data is encrypted. Of those, 46 percent paid the ransom. And only 4 percent of those that did pay got all their data back.
Cybercriminals are getting smarter. They offer ransomware as a service (RaaS) to specialists whose skills in, as Sophos puts it, “virtual breaking-and-entering,” differ from those of ransomware creators. As per an alert by the Cybersecurity and Infrastructure Security Agency (CISA) of the US government, notes that for one RaaS called Conti, bad actors often try to gain initial access using spear phishing campaigns with tailored emails containing malicious attachments. But they’ve got plenty of other burglary tools up their sleeve. Among those listed by the government agency includes:
- Stolen or weak Remote Desktop Protocol (RDP credentials)
- Phone calls—yes, some hackers even cold call a company to try to wring the information they need to get onto your network
- Fake software promoted via SEO
- Malware distribution networks like ZLoader
Then there is the bottom-line impact. The Sophos report says the average cost to remediate a ransomware attack was $1.4 million, and the average time it took to recover from an attack was one month.
When you look at all of this, you are potentially only a click on a malicious link away from a potentially devastating ransomware attack on your organization.
IT Transformations Add Complications
It would be best to do everything to fight back against ransomware. But that isn’t easy with today’s increasingly complicated IT infrastructures. You may have a hybrid workforce using personal devices to connect to your network. And with IoT prevalent across many industries, you may be dealing with a massive increase in attack surfaces and vulnerabilities. Then there are your servers, endpoints, networks, network-attached storage, clouds, applications, and more that need to be protected from ransomware.
With so many potential vulnerabilities and evolving attack vectors, IT professionals need to change their approach because beating ransomware requires a multi-faceted prevention strategy. No single silver bullet will keep ransomware at bay, especially given so many other threats to your data, from malware to natural disasters.
Three Pillars of a Complete Ransomware Prevention Strategy
1. Cybersecurity Technologies
Cybersecurity is a crucial aspect of your multi-faceted ransomware prevention strategy. It includes ensuring you have the latest protections for your endpoints, networks, servers, and other infrastructure elements.
At a minimum, it’s worth adding Identity Access Management (IAM) to keep unauthorized users out and Privileged Access Management (PAM) solutions to limit access to sensitive data based on roles. Bolstering your defenses further by employing a zero-trust model for data protection with advanced monitoring functionality means your backup admins can react quickly to any threats or other issues involving your primary or backup infrastructure and operations. Your defenses can include data loss prevention (DLP) software that detects potential data breaches and data exfiltration activities and blocks them from accessing sensitive data—in use, in motion, and at rest.
Endpoint detection and response (EDR) is another cybersecurity tool that continuously monitors end-user devices to detect and respond to cyber threats. If your organization uses a remote or hybrid work model, EDR is invaluable.
2. Data Protection and Orchestrated Recovery
Now that ransomware targets backups much more frequently, the old 3-2-1 backup rule is outdated. That rule was simple: keep three copies of your data; store two copies locally on two formats (tape, network-attached storage, or local drive); and keep one copy offsite, with the cloud offering the most flexibility. To deal effectively with today’s threat, you need to adopt a 3-2-1-1 strategy with that extra one standing for immutability.
Backups to an immutable object store are in a write-once read many times format. These immutable backups can’t be altered or deleted, so they are safe from ransomware no matter what.
If you experience a successful ransomware attack or other data loss, orchestrated disaster recovery will help you recover efficiently. An effective orchestration solution also ensures that your critical systems—servers, applications, and sensitive data—are automatically brought back online in the proper order. That takes much of the complexity out of recovery. Given the multiple tasks that go into a manual failover, orchestration ensures fast disaster recovery, even as you scale your organization.
3. Security Processes
The final pillar may be the most critical because 85 percent of breaches in 2021 involved the human element. Cybersecurity training should be a core element of your disaster prevention and recovery plan. Make sure your team understands how to spot phishing schemes and suspicious links. Help them know how vital their role is in preventing ransomware and breaches.
It’s also essential to run disaster recovery exercises that test your disaster recovery plan’s effectiveness. And don’t forget to keep physical security in mind, including running background checks. Finally, we want to reiterate the value of IAM and PAM in keeping your data secure.
A Unified Approach
For organizations to effectively take the fight back against cybercriminals requires a more unified and holistic approach to data protection. It should be built on the pillars discussed in this article. It becomes a more comprehensive and complete defense by unifying your approach, making it much harder for ransomware and other attacks to sneak in through the cracks.
By Nikhil Korgaonkar, Regional Director, Arcserve India & SAARC
