The volume of ransomware attacks was unprecedented in 2021. For instance, in the third quarter of the year, security researchers documented 190.4 million ransomware attempts. This volume made Q3 2021 the highest quarter ever recorded, reported by Help Net Security. The period almost surpassed the 195.7 million ransomware attack attempts logged during the first nine months of the previous year. The report predicted a total of 714 million ransomware attack attempts for all of 2021, a volume that would have marked a 134% year-over-increase. Reflecting on these findings, most organizations in various sectors expect to become the target of a ransomware attack in the future. As noted by HealthITSecurity, more than half (57%) of those organizations attributed their viewpoint to the fact that ransomware actors have already targeted so many other organizations in the industry.For example, 48% of IT managers at local government agencies, and 63% of central government respondents in a survey covered by StateScoop, said that they expected their employer to suffer a ransomware infection in the future. In another study, 63% of healthcare organizations revealed their belief that ransomware actors would target them at some point. A Cybereason study, titled Ransomware Attacks and the True Cost to Business, found that 66% of organizations reported a significant loss of revenue following a ransomware attack, and 53% of organizations indicated that their brand and reputation were damaged as a result of a successful attack, demonstrating that ransomware attacks pose a significant risk to a business’s viability.Practice good security hygiene like implementing a security awareness program for employees, assuring operating systems and other software are regularly updated and patched, and deploying the best-in-class security solutions on the network. Develop a repeatable Incident Response plan as critical response actions can be delayed during weekend/holiday periods. MSSPs should be able to respond quickly and at odd hours to a ransomware attack. They should have an ability to rapidly mitigate further spread, but also to understand the root cause, number of machines affected, and stop the leak of data or further encryption or privilege escalation. Ensure clear isolation practices are in place to stop further ingress on the network or spread of the ransomware to other devices. Teams should be proficient at disconnecting a host, locking down a compromised account, blocking a malicious domain, etc. Testing these procedures with scheduled or unscheduled drills at least every quarter is recommended to make sure all personnel and procedures work as expected. Lock-down of critical accounts because the usual path attackers take in propagating ransomware across a network is to escalate privileges to the admin domain-level and then deploy the ransomware. Teams should create highly-secured, emergency-only accounts in the active directory that are only used when other operational accounts are temporarily disabled as a precaution or inaccessible during a ransomware attack. Contact Law Enforcement Immediately upon discovering a ransomware attack, including the FBI and local authorities immediately upon discovering an attack. They must do this despite what some ransomware gangs have started telling victims (here’s looking at you,Grief Gang). Help your customer weigh the decision to pay a ransom Carefully: Doing so doesn’t always help victims regain access to their data. About half of respondents in our ransomware study cited above said that some or all the data to which they regained access following the payment was corrupted.
Guest blog courtesy of Cybereason. Read more Cybereason guest blogs here. Regularly contributed guest blogs are part of MSSP Alert’s sponsorship program.