Ransomware: visibility is the best defence

How have the tech­niques and work­ings of cyber­crim­i­nals evolved in recent years?

We’ve seen cyber­crime groups adopt cyber tac­tics devel­oped and used by nation states to dis­cov­er vul­ner­a­bil­i­ties in organ­i­sa­tions and run attacks. Ran­somware has grown mas­sive­ly. A lot of peo­ple still think about the Wan­naCry ran­somware attack in 2017, but it’s evolved enor­mous­ly since then. With the rise of ran­somware-as-a-ser­vice, you don’t even have to be a sophis­ti­cat­ed hack­er your­self as you can just use tools devel­oped by some­one else to con­duct ran­somware attacks.

And cryp­tocur­ren­cy has incen­tivised crim­i­nals with the promise of a big pay­out while remain­ing anony­mous. It’s matured and become weaponised – we now have what we call ‘big game’ ran­somware, where attack­ers infil­trate a com­pa­ny very sub­tly, such as via a phish­ing cam­paign or mali­cious web­site, and then look to locate valu­able, sen­si­tive infor­ma­tion. They go under the radar by using cre­den­tials for autho­rised users to look for crit­i­cal infor­ma­tion before steal­ing and encrypt­ing it and demand­ing a ran­som, often in the hun­dreds of thou­sands or mil­lions.

Cyber­crime groups are like the heads on the myth­i­cal Hydra — when one is tak­en down by author­i­ties, through col­lab­o­ra­tion with oth­er crim­i­nals, they very quick­ly reform, reor­gan­ise and start attack­ing again.

What risks do organ­i­sa­tions face when they lack vis­i­bil­i­ty across their data?

The biggest risk is over­ex­posed data. It presents a mas­sive chal­lenge to near­ly every organ­i­sa­tion. On aver­age, an employ­ee has access to about 17 mil­lion files. That sounds enor­mous, and it is. As a result, when organ­i­sa­tions are sub­ject to a breach or attack, they’re caught off guard. The sheer vol­ume of data means their attack sur­face is way big­ger than it should be, and they’re unpre­pared for that. Lack­ing vis­i­bil­i­ty — and there­fore knowl­edge — of where the most impor­tant and sen­si­tive data resides, as well as who has access to it and who has changed, copied, delet­ed, or stolen it, ampli­fies the chal­lenges of deal­ing with an attack.

How chal­leng­ing is this, specif­i­cal­ly to enter­prise data, on-premis­es and in the cloud?

The chal­lenge is huge. Data is stored in many dif­fer­ent places and con­tin­ues to grow on a dai­ly basis, bring­ing more com­plex­i­ty which, in turn, opens organ­i­sa­tions to more risk and over­ex­po­sure. Most com­pa­nies are blind when it comes to their most sen­si­tive data.

If you don’t know if a user has copied sen­si­tive GDPR-pro­tect­ed data to their own com­put­er, or opened sen­si­tive HR files that they shouldn’t have access to, you won’t know when your organ­i­sa­tion is attacked. All organ­i­sa­tions should be able to under­stand their blast radius — the poten­tial dam­age an attack­er could do once they land on their net­work — but many can only guess.

Unless you’re watch­ing who can and who does access data, and what they’re doing with it, you will inevitably miss any signs that a cyber attack is under­way. With­out vis­i­bil­i­ty into your data, you can’t spot sus­pi­cious or unusu­al activ­i­ty ear­ly, which is the key. If you’ve ever received a ran­somware noti­fi­ca­tion, you know the sink­ing feel­ing in the pit of your stom­ach. If you under­stand your blast radius you can reduce it and ulti­mate­ly min­imise the effects of an attack.

How does Varo­nis help organ­i­sa­tions to increase data vis­i­bil­i­ty and improve their cyber defences?

We have worked with many com­pa­nies that have been hit by ran­somware before and know far too well the effort and the costs required to recov­er. The most suc­cess­ful com­pa­nies proac­tive­ly reduce their blast radius by mit­i­gat­ing data that’s over­ex­posed. They archive and delete infor­ma­tion they shouldn’t store any­more. Pre­ven­tion is key to reduc­ing the attack sur­face, so that’s where we start with all our cus­tomers. You have to under­stand what your land­scape looks like and then go through as many pre­ven­tion activ­i­ties as you can to reduce that attack sur­face.

We also help organ­i­sa­tions defend against insid­er threats. It’s real­ly dif­fi­cult to deter­mine when a val­ued employ­ee, with access to sen­si­tive data, sud­den­ly starts behav­ing in a way they shouldn’t. One of our cus­tomers spot­ted and stopped an employ­ee steal­ing sen­si­tive pric­ing infor­ma­tion they were going to give to a com­peti­tor, because they had vis­i­bil­i­ty into what was going on with their most sen­si­tive data.

Aside from tech­nol­o­gy, what else do com­pa­nies need to do to ensure employ­ees have the appro­pri­ate access to data?

This real­ly should fall into what is typ­i­cal­ly known as the join­ers, leavers and movers (JLM) process. When peo­ple are onboard­ing with a com­pa­ny, a deci­sion should be made at that stage about what access they should have. That should come through con­sul­ta­tion with the joiner’s man­ag­er, who ulti­mate­ly knows what data their team should be work­ing with. It’s a mat­ter of involv­ing the busi­ness own­ers in that onboard­ing process, and mak­ing sure they make that incred­i­bly impor­tant deter­mi­na­tion.

We typ­i­cal­ly find about 50% of user accounts in an organ­i­sa­tion are either stale or inac­tive. They’re just not being used, and if they’re not being used they’re typ­i­cal­ly not owned by any­body any­more. When these accounts are then used for mali­cious pur­pos­es, it’s unlike­ly that anybody’s going to spot it. It’s about good house­keep­ing.

How do you see the cyber risk land­scape con­tin­u­ing to change?

I think it’s fair to say that the tac­tics are going to con­tin­ue to fil­ter down, from expe­ri­enced attack­ers to oppor­tunists. It’s a very open envi­ron­ment out there and once these vul­ner­a­bil­i­ties are dis­cov­ered, even ama­teur cyber­crim­i­nals can make use of them. We’re also going to see a lot more exploita­tion of cloud infra­struc­tures or resources, which are avail­able 24/7. Con­tin­ued remote and hybrid work­ing is replac­ing tra­di­tion­al on-premise net­works with perime­ter-less net­works in which every lap­top or mobile phone becomes a gate­way to your crit­i­cal and sen­si­tive data. All of this just makes it even more cru­cial to gain vis­i­bil­i­ty of enter­prise data.

For more infor­ma­tion, vis­it varonis.com

Pro­mot­ed by Varo­nis