Ransomware is showing up all over the place, from CDK Global’s lengthy outage, which made news headlines this past July, to several outages at hospitals, city governments, and the British Library. Outages result in companies’ operations being beleaguered. For example, in each case related to the CDK Global outage, these organizations and their customers were impacted, as shipping and fuel delivery were impaired, or car dealers were unable to service their customers. In some cases, the adage “crime pays” proved true as organizations had to pay exorbitant ransoms in Bitcoin to criminals to get data back.

Actions you can take to protect yourself from the ransomware blues

No strategy is foolproof, and larger organizations have more difficulty as data becomes more fragmented and decentralized. But, no matter the size of your organization, there are several actions you can take to mitigate the risk of ransomware.

Backup, Backup, Backup

Backup critical information. Backups must be redundant, frequent, and isolated from their sources. If a single computer can access the backup medium and overwrite it, then ransomware can encrypt it.

Immutable Services

Run servers and services from immutable sources, such as docker repository or a golden image built by an isolated build pipeline, to ensure that if a service is compromised, a restart will restore its operation. Meanwhile, closing the vector of compromise or infection will still be required or the compromise will be repeated.

Data Isolation

Isolate critical data from general user computers. Documents, databases, and datastores must be accessed through APIs, applications, or gateways that limit or prevent general access. Most ransomware uses common protocols such as phishing, fake downloads, and network file sharing, to spread its destruction quickly, according to Crowdstrike’s 10 most common infection methods. Preventing those protocols from accessing critical datastores is a key design decision in running web-based applications. Isolating general purpose computer devices, such as end-user desktops and laptops, and making them disposable is a key step towards ransomware resiliency. This is done through defense in-depth, separating servers and other compute devices away from each other – using active authentication, rather than pass-through authentication, and applying least privilege to datastores.

Data Restoration

Make a data restoration plan from backup. There is often a window between the present and most recent backup of any datastore. That window must be evaluated to determine what level, if any, of data loss is acceptable. Once determined, the backup schedule must be aligned within that window with restoration time taken into account. If you have your data, but can’t access it, that is still an availability failure. Knowing how to restore data and how long it will take is critical to resuming normal operations.

Planning & Preparation

Educate users about ransomware, and also understand that end users will always be the weak link – education will only go so far. Incident handling teams should regularly review how to handle ransomware attacks. Plan for knowable scenarios and be ready when something does happen.

Preventing the ransomware blues takes time, attention, and preparation. Knowing how to recover before an event occurs is critical to sustained business operations. Recovery is a common focal point of tabletop exercises that many of our clients adopt in their SOC2 implementations.

Becoming a victim of a ransomware attack harms customer confidence, leads to possible data loss, or worse – loss of data integrity. One of the goals of many Ransomware tool kits is to replicate itself, so beyond harm to your business and customers, a victim potentially becomes another vector for the spread of malicious software. Finally, ransomware is itself a business, like any other. It continues because it is profitable. The only way to combat it is to take the profit out, by preparing to recover rather than risk paying the ransom, which may not restore your data after all. Castlerock can help you evaluate and plan and prepare for the eventuality of such an event.