Defending Against Ransomware Means Preventing It

person drawing a sports play on a chalkboard

With the increasing rate of ransomware attacks, it isn't matter ofifyouwillexperiencean attack, butwhen.As reported by, the global volume of ransomware rose to 304.7 million in the first six months of 2021. That’s 0.1 million more than the total numberofattack attempts recordedby security researchersin all of 2020.Organizations need to be on the offense when it comes to defending against ransomware attacks. But what does “ransomware defense” mean exactly and what does it look like in practice?Let’s break it down.

Understanding the Costs of a Ransomware Attack

, Cybereason observed that aransomwareattackinflicts multiple points of damage against a victim.These costsmakedefending against ransomwaredifficult once an attack has begun.

Consider the following findings from Cybereason’s study:

  • Two-thirdsof respondents indicated that their organizationhadlost significant revenue following a ransomware attack.
  • More than half(53%)of survey participants reported that a successful ransomware attackhaddamaged both their brand and their reputation.
  • Close to a third(32%)of organizations revealed that theyhadlost C-Level executives as the direct result of a successful ransomware attack.
  • A slightly lower proportion(29%)of survey respondents found themselves in a position where they needed to lay off employees due to the financial pressures that theyhadincurred following a ransomware infection.
  • About a quarter(26%)of organizations wrote that a ransomware attackhadforced them to temporarilysuspend operations attheir business.

Paying the ransom didn’t alleviate the costs for victims. Sometimes,victimscouldn’trecover their information even after paying the requested ransom.Nearly half (46%) of respondents in Cybereason’s survey said that theyhadregained access to their data after fulfilling a ransom demand but that the attackhadleft some orall oftheir data corrupted. Only 51% of victims regained access to all their data without any data loss after paying the ransom, while three percent didn’t restore any of their data following payment.

Other times, complying with a ransomware attacker’s demands just made things worse by inviting follow-up attacks. Of those organizations that told Cybereason they had paid the ransom, for example, four-fifthssaid they hadincurred another ransomware attack. Nearly half (46%) of those respondents believed that the attack originated from the same attackers. Meanwhile, 34% articulated their belief that the attack had originated from a different ransomware group.

Follow-up attacks aren’t uncommon with ransomware actors. As I noted inmy article on double extortion,digital attackers don’t always honor instances in which victims pay theransomforthe deletion of their stolen data.Security researchers observed some gangs re-extorting victims for the same data just weeks after receiving a ransom payment—all to collect even more money. Other ransomware gangs went ahead and posted a victim’s stolen information on their data leaks website despite having already collected payment.

Understanding Ransomware Defense

So, what do Cybereason’s findings mean when it comes to defending against ransomware?They highlight howorganizationscan bestdefend against ransomwareby trying toprevent an infection from occurring in the first place.One way to dothisis toreducethe risksassociated with phishing emails by investing in asecurity solutionthat scans their incoming email messages for IP addresses, campaign patterns, and other threat behaviors. If the solution conducts its analysis in real time, it will also ensure that organizations can remain protected without suffering extendedbusiness disruption.

ճagrees with the need to implement an email filtering solution to prevent phishing,but they have alsoissued a list ofotherpromisingrecommendationsto preventransomware attacks:

  1. Applybest practices when usingRDP /remote desktop servicestopreventattackersfrom using this as a common entry point.
  2. Regularly scan and auditfornetworkvulnerabilities– CISA offers various no-cost scanningservices. Also, with email beingone of(if notthe most)common threat vectorfor ransomware,you canalsoconduct anemail securityauditto help source and remediatepotential vulnerabilitiesquickly.
  3. Ǵڳٷɲܱ-ٴ-岹ٱincluding operating systems, servers, applications,anti-virusandanti-malware software,and every other potential software that can be abused to gain access to your network.
  4. Securealldevices (laptops, mobile phones, etc.)that have access to your networkand ensure they follow companysecurity policies.
  5. Employmulti-factor authentication (MFA)rather than allowing users to login with a password alone.
  6. Implement a cyber security awareness training programforemployees to know the risks of working in a digital world.
  7. Manage access properlylike limiting privileged accounts and developing an allow list for applications.
  8. Have arobustdatabackup strategyin placethat backs up your data regularly – this won’t necessarily prevent ransomware threats, but it will surely help you recoverdata from any point in timeif the need arises.

You can readCISA’sfull recommendation on ransomware-caused data breachesorcontinue reading aboutotherransomwaretopicsbynavigatingtotheSecure Modern Workplace blog series.