Ransomware is perhaps the most disruptive and infuriating security threat facing businesses in 2022. A ransomware infection is a symptom of an information and infrastructure security failure that may hurt a business’s reputation and pose a compliance risk. Ransomware not only deprives a business of data essential to its operations; it also forces business leaders to decide whether to pay off criminals—an action that has ethical, financial, and legal implications.

Over the last few years, ransomware has become a persistent threat to businesses of all sizes. According to Sophos’s The State of Ransomware 2021, 37% of businesses were hit by ransomware over the last year. The average ransom paid was $170,000, but the total cost of ransomware attacks—taking into account the ransom, downtime, mitigation costs, and staff time—averaged $1.8 million. Most chillingly, the average victim who pays retrieves only 65% of encrypted data—most ransomware victims suffer permanent data loss even when they pay.

Ransomware is likely to become more prevalent in 2022. It remains a high-value revenue generator for cybercriminals. The Treasury Department estimates that criminals made $600 million from ransomware in the first six months of 2021 and expects the year’s total to exceed the combined ransom payments of the previous ten years. The true cost is likely much higher because businesses are motivated to hide successful attacks once they pay a ransom.

What is Ransomware?

Ransomware is malicious software that encrypts files using a key known only to the ransomware operator, who then demands a ransom in exchange for providing the key to decrypt the data. The ransom demand typically asks for payment in an untraceable cryptocurrency. If the victim pays, they usually—although not always— receive the key and can therefore retrieve the lost data.

The most commonly encountered variants in 2021 included REvil/Sodinokibi, Hades, and DoppelPaymer, although one of the most impactful attacks of the year was carried out by the Darkside cybercriminal group, whose attack against Colonial Pipeline disrupted the supply of fuel to the East Coast for a week in May and resulted in a ransom payment of 75 bitcoins, equivalent to $4.4 million at the time the ransom was paid.

What Causes Ransomware?

Ransomware depends on an existing vulnerability to infiltrate a target system. The most common methods of infiltration are phishing attacks, brute force attacks, attacks against insecure RDP services, and the exploitation of software vulnerabilities. For example, the REvil/Sodinokibi ransomware spread through brute force attacks and server exploits, among other vectors. It initially used a vulnerability in Oracle WebLogic to download the code which encrypts the victim’s files, but the method used changes over time because ransomware is constantly evolving as criminals seek to exploit new vulnerabilities.

Can Data Encrypted By Ransomware Be Recovered?

Businesses should assume that once their data is encrypted by ransomware, it cannot be retrieved. Ransomware uses sophisticated cryptographic technology that cannot be reversed without the key. In the past, security experts have managed to reverse the encryption of poorly coded ransomware, but that is unlikely to happen for modern ransomware.

In some cases, including REvil/Sodinokibi, law enforcement agencies were able to identify and infiltrate the ransomware operator’s infrastructure, allowing them to extract the master key and build decryption software. However, it’s rare that this happens on a time-frame acceptable to businesses, and the most likely outcome of a successful ransomware attack is that data is irretrievably lost until the victim pays a ransom and the attacker provides a decryption key—although there is no guarantee the data will be retrieved even if the ransom is paid.

Should Businesses Pay the Ransomware Ransom?

The temptation to pay a ransom is understandable, especially if your business is facing severe disruption because critical data is no longer available to employees or customers. Many businesses choose to pay. But, as we mentioned earlier, businesses that pay get an average of 65% of their data back. Only 8% get all of it back. Even if you do pay, it’s unlikely your business will be made whole.

Furthermore, the attackers may not delete their copy of the data. It is increasingly common for ransomware attackers to sell or otherwise disclose stolen data. In fact, some ransomware attackers don’t encrypt the data at all. They steal it and promise to delete what they stole if paid a ransom. Needless to say, criminals are not always honest.

It is not usually illegal for U.S. businesses to make ransomware payments. However, the U.S. Department of the Treasury’s Office of Foreign Assets Control issued an advisory in 2020 declaring that it is unlawful to facilitate ransom payments to attackers on the Department of Treasury sanctions list. The FBI advises businesses not to pay ransoms for the reasons we’ve discussed. It also encourages businesses to report ransomware attacks to the Internet Crime Complaints Center.

How to Prevent Ransomware: 6 Ransomware Protection Best Practices

Once the sole copy of a business’s data is encrypted by ransomware, its options are limited. Therefore, it is preferable to prevent ransomware infection in the first place and to ensure that important data is copied to a location ransomware cannot reach.

Regularly Update Software to Apply Security Patches

Many ransomware infections start with software vulnerabilities. The attacker exploits the vulnerability to gain access to a network and then uses that access to infiltrate their malware. It is not possible to guarantee a system is free from exploitable vulnerabilities, but updating software regularly ensures that known vulnerabilities are repaired.

To underline the importance of regular software patching: the EternalBlue vulnerability, which was widely exploited by the catastrophic WannaCry ransomware campaign, was fixed by a software patch months before attacks began. Victims were vulnerable because they had not updated the relevant software.

Back-Up Data to a Secure Remote Location

Ransomware is effective because it deprives businesses of the data assets they need. But that can’t happen if the data also exists in a secure offsite location the malware cannot access. Sophisticated ransomware is capable of finding and encrypting local backups on connected systems, so an effective backup must copy data to a system that is not easily reachable over the local network.

If the business has an up-to-date backup, they can simply delete the infected systems and restore or deploy cloud disaster recovery infrastructure with their apps and the backup data.

Implement Least-Privilege Access Policies

Data should be accessible only to users and services who need it. The more people who have access, the greater the likelihood credentials will be leaked or stolen. If an individual no longer needs access, revoke their permissions.

Limit permissions to those that are required. For example, if a user needs to see information but not to change it, ensure they only have read permissions and not write permissions on the database, disk, or cloud storage service that stores the data.

Follow Cloud and Physical Infrastructure Configuration Best Practices

Cloud configuration errors often lead to vulnerabilities a ransomware attacker can exploit. For example, incorrectly configured access permission on AWS S3 buckets may allow ransomware attackers to download, edit, and delete data. Ensure your business follows industry best practices for data security. If your business lacks the expertise to secure its data, hire a professional who can assess your security implementation and provide guidance.

We wrote more about cloud security best practices in 10 Top Tips For Better AWS Security Today

Carry Out Regular Security Risk Assessments

Ransomware attacks often occur because a business misunderstands risks associated with their behavior or their system’s implementation. The BlueEternal example discussed above is a useful illustration; most businesses know that updating software is a good idea, but they choose not to because they don’t apprehend the seriousness and potential cost of living with that risk.

Risk assessments help businesses to understand potential security threats, including threats that may lead to a successful ransomware attack.

Implement Security Awareness Training

Phishing attacks are one of the most widely exploited ransomware vectors. Attackers send an email to employees or managers containing a link. The link takes the target to a site that infects their system with malware or that dupes them into entering authentication credentials.

One way to combat phishing is to ensure that employees recognize the signs. To achieve that you’ll need to train every employee who might pose a risk. Security awareness training is required by several regulatory frameworks and organizations, including FINRA, HIPAA, and AICPA.

Prevent Ransomware with KirkpatrickPrice

Ransomware is a pressing security threat facing businesses in 2022. If you’d like help to identify and mitigate ransomware risks with remote security services, security awareness training, or a compliance audit, contact a KirkpatrickPrice information security specialist today.

As we enter a new year, it’s traditional to look back at the successes and failures of the last twelve months. The information security world is no different, and as the year draws to a close, information security writers publish a flurry of articles with titles like The Top Data Breaches of 2021 and The Top 5 Scariest Data Breaches in 2021. They are sobering reading: each listicle entry represents hundreds of millions of people hurt by data breaches that expose their private details to criminals and the wider world.

However, these articles don’t mention the thousands of smaller businesses targeted by cyber-criminals. The headline-grabbing data breaches are the tip of the iceberg. While most of the corporations featured will weather the storm, smaller businesses are less able to bounce back from a catastrophic exposure of sensitive data. Over half of small companies go out of business within six months of a data breach or cyber attack.

Data breaches are avoidable, but any business can significantly reduce the risk that a data breach will hurt its employees and customers, not to mention its reputation, bank balance, and regulatory compliance.

What Causes Data Breaches?

Data breaches occur when bad actors exploit weak security and privacy controls. In a secure system, sensitive data is only accessible to authorized and authenticated users. To build a secure system, businesses should implement controls that allow access to authorized users and deny it to everyone else.

Data breaches are more likely when essential controls are missing or improperly implemented. A weak password is an example of a poorly implemented access control. If a user with administrative privileges on a sensitive system chooses a password such as “123456,” an attacker can easily guess it and gain access.

Weak credentials are among the most common causes of data leaks, but there are many more, including:

  • Stolen credentials: shared or stolen passwords and authentication keys are a leading cause of data breaches.
  • Phishing attacks: attackers use email to trick employees into disclosing credentials or installing malware.
  • Software vulnerabilities: vulnerabilities in network-connected software allow attackers to access sensitive systems.
  • Insider threats: employees or ex-employees work with criminals or steal data for their own purposes.
  • Physical attacks: people who have direct physical access to servers and networks can bypass security controls.
  • Configuration mistakes: incorrectly configuring software or hardware may give an attacker access to sensitive data. This is a common cause of data breaches from cloud platforms, as we discussed in 10 Top Tips For Better AWS Security Today.

What Happens During a Data Breach?

There are many potential techniques an attacker might use to compromise a business’s network and exfiltrate sensitive data. But, at a high level, most data breaches follow a predictable course.

  • Target identification and surveillance: The attacker probes your network and organization for weaknesses. This stage may be automated: many attackers use bots to probe thousands of networks for specific security weaknesses. However, an attacker may manually probe and investigate a high-value target.
  • Social engineering: In addition to probing networks and software, the attacker may contact employees and managers, usually misrepresenting their purpose with a spurious pretext. Their aim may be to learn more about the organization and its systems, steal authentication credentials, or influence an insider to install malware.
  • Compromise: The attacker uses the information they have gathered to gain entry to the network. For example, they may have discovered a misconfigured database, which they now access over the internet. Once the attacker has compromised one network component, they may use that access to “island hop” to more sensitive systems.
  • Exfiltration: The data is copied from the business’s network to servers under the attacker’s control.

Once the attacker has the data, they can release it to the public, sell it to third-party data brokers, use it for identity theft, or extort the businesses.

How to Prevent Data Breaches

We’ve looked at some of the most widely used techniques to compromise business networks and steal data. To prevent data breaches, businesses should focus on implementing processes and controls that render those techniques ineffective.

Regularly Update Software to Apply Security Patches

Older software often contains bugs that create security vulnerabilities. The recent Apache log4J vulnerability is a perfect example. Log4j is a logging tool for the Java programming language ecosystem. It is included in over 35,000 Java packages used by thousands of businesses.

Log4J contained a security vulnerability an attacker could exploit to execute code remotely. Remote code execution vulnerabilities are severe, and the log4J vulnerability could allow an attacker to break into systems, steal data, and upload malware.

Once the vulnerability was discovered, developers quickly fixed it. But, to get the non-vulnerable version, users have to update any software that uses log4J. Although the log4J vulnerability is particularly serious, software vulnerabilities are common, and the best way to fix them is to update all business software regularly.

Encrypt Data and Store Encryption Keys Securely

Businesses should not entirely rely on their ability to keep bad actors out of their networks. It’s always possible that an attacker will find a vulnerability or an employee will make a configuration mistake. It’s best to assume that an attacker will find their way in and implement additional layers of security to deal with that contingency.

If a business ensures that all data is encrypted, an attacker who penetrates network security cannot access the original data. However, a sophisticated attacker may discover encryption keys if they are not also stored securely. The details of secure key storage differ depending on the business’s platforms, but we discussed how to store access securely and encryption keys on Amazon Web Service in How to Keep AWS Access Keys and Other Secrets Safe.

Implement Least-Privilege Access Policies

Employees, contractors, and service providers should have the least access consistent with their role within an organization. They should be able to access only the data they need and have only essential privileges. For example, an employee who needs to download data to generate a report does not need write permissions to edit that data.

Implementing least-privilege access policies limits the risk of leaked or stolen access credentials. It also helps to reduce insider threats by limiting the data assets a malicious insider can access.

Follow Cloud and Physical Infrastructure Configuration Best Practices

Many data breaches are the result of improperly configured software and hardware. To mention just four examples:

  • AWS S3 buckets that are accidentally configured to be publicly accessible.
  • MySQL databases deployed without password authentication.
  • Improperly assigned access permissions that allow users to access information they should not be authorized to see.
  • Inadequate firewall rules or a failure to use a firewall.

Configuration errors have two leading causes. First, the business doesn’t invest the time and resources necessary to secure its infrastructure adequately. Second, the business lacks the knowledge and expertise to configure its infrastructure securely. Both scenarios introduce significant compliance and financial risks.

If a business does not have the knowledge or resources to secure its infrastructure or understand the risks, it should consider employing a third-party information security specialist to assess its security and suggest opportunities for improvement.

Carry Out Regular Security Risk Assessments

A security risk assessment can help your business identify and remediate potential vulnerabilities. A comprehensive risk assessment begins with a survey of your infrastructure before identifying risks, assessing their importance, and creating a risk management plan, which can be implemented to remove identified risks.

A third-party risk assessment by qualified information security auditors may help businesses significantly reduce the risk of a damaging data breach.

Conduct Security Awareness Training

Employees have privileged access to sensitive data, but they may not understand their part in keeping that data safe. Phishing attacks and other forms of social engineering deliberately target non-technical employees who may not understand the security implications of clicking a link in an email or sharing their password with someone who claims to be a manager or executive.

Security awareness training helps employees understand the threats their business faces and what they can do to limit exposure. It can be tailored to the company’s specific needs and relevant security frameworks, including HIPAA and PCI.

Prevent Data Breaches with KirkpatrickPrice

As a licensed CPA firm, KirkpatrickPrice specializes in information security audits and security assessments that can help protect your organization from being vulnerable to data breaches. Contact an information security specialist to learn more about our risk assessment services, security awareness training, and compliance audit services.

As cyber threats continue to be a major concern for business owners, not having a cybersecurity strategy in place is no longer an option. You must be prepared to defend your business from cyber threats and be proactive with your cybersecurity prevention strategies. Here are 5 easy ways to defend your business from cyber threats.

1. Know Your Risks

As auditors, we frequently talk about risk assessment and risk management strategies as the foundation of any information security and cybersecurity program. By performing a formal risk assessment, your organization can gain a clear picture of where your assets lie, and what internal and external vulnerabilities exist. Keeping an awareness of the threat landscape and the cybersecurity threats that exist can help defend your business from cyber threats.

2. Promote a Culture of Cybersecurity

The workforce is any organization’s critical line of defense, and with the threat landscape rapidly changing, it’s important to keep employees on their toes at all times. Creating a culture of cybersecurity can help encourage employees to be aware of cyber threats and help to educate the workforce on recognizing and preventing cyber threats from occurring.

3. Ensure Hardening Standards

Implementing hardening standards is an important step to defend your business from cyber threats. System and network hardening, also known as “defense in depth,” is a great approach to eliminating the potential of a cyberattack by creating multiple layers of protection. A strong perimeter firewall, anti-virus, strong passwords, IDS, and physical access controls are all examples of hardening techniques. Using these controls in combination can help to defend your business from cyber threats.

4. Encrypt Everything

Strong encryption is an easy way to defend your business from cyber threats as it helps to protect sensitive data that you don’t want to end up in the wrong hands. Encryption can allow sensitive data (from credit card numbers, health information, or any other personally identifiable information) to transfer across networks without being compromised or accessed without being authorized.

5. Update Your Software

As many organizations have learned the hard way over the last couple of years, leaving critical updates to software and operating systems unpatched could lead to serious vulnerabilities waiting to be exploited by a malicious attacker. Best practices state that patches that are released as critical should be implemented within 30 days of release.

Don’t wait until you’re under attack from a cyber threat before you start having the conversation of cybersecurity at your organization. Take steps now to defend your business from cyber threats. For more information or help with ramping up your cyber security program, contact us today.

It’s become quite common to see reports in the headlines about data security breaches as different types of organizations are targeted every day. The types of information or data that is stolen as a result of a breach are things like social security numbers, credit card numbers, Protected Health Information (PHI), and Personally Identifiable Information (PII), trade secrets, or intellectual property. The most important thing to consider when it comes to protecting against data breaches is it’s not a matter of if, but when, so be sure to prepare for a breach with both prevention and recovery in mind. It’s also important to be aware of what state and/or federal data breach notice laws may apply to you in the event of a security incident at your organization.

There seems to be a lack of distinction between a security incident and a data breach; not every security incident constitutes a security breach. A breach has occurred when sensitive, protected, or confidential information has been accessed or stolen by someone without the proper authorization to do so. Maybe it’s a lost laptop, a malicious hacker, or accidentally sending sensitive information to the wrong person, it’s important to carefully evaluate every security incident to ensure you are following all applicable data breach laws in the event of an actual breach.

KirkpatrickPrice uses the Six Steps of Incident Response to help organizations determine the severity of a security incident and how to efficiently and effectively remediate. When developing your own incident response plan, take a look at these six common stages of incident response:

1. Preparation

Always document policies and procedures for appropriate disaster recovery to ensure that recovery and remediation will happen quickly. Are you prepared to handle an incident that could happen today?

2. Detection and Identification

What kind of incident has occurred? What is the severity? Has there been loss or exposure of sensitive data? Were any laws or contracts violated? How much information was impacted by the incident?

3. Containment

Notify the right people at the right time to help reduce the damage of a security incident and isolate the infected or compromised area.

4. Remediation

Resolve any issues, malicious code, responsible personnel, threat, etc. What security gaps need to be addressed at this time?

5. Recovery

Implement all appropriate policies and procedures to get back up and running and continue to monitor that the incident has been fully resolved.

6. Lessons Learned

Make sure you know why the incident occurred so you can ensure that the same incident will not happen again.

For more insights on data security, follow @BenjaminWright on Twitter. To learn how KirkpatrickPrice can help you meet your compliance objectives, contact us today!

 

 

A topic in the news is Data Security Breach. We see a lot of reports about organizations notifying the public that they’ve suffered some kind of a breach of information security. So an example of Data Security Breach could be that social security information has been compromised, or maybe credit card information is no longer protected. There are many laws covering Data Security Breaches. Those laws can be state laws, federal laws, or they might be the laws of other countries. These laws  are not uniform and therefore it can be quite confusing for an organization to figure out exactly which law applies when the organization thinks it may have a security breach.

Not every security incident constitutes a Data Security Breach. You may have a lost laptop computer, maybe an employee loses a smart phone, maybe an employee accidentally sends sensitive information to the wrong people. Not every one of these kinds of incidents turns out to be a Data Security Breach under the relevant laws for which you need to give notice. Therefore, when an organization sees that it has an incident, it needs to conduct an appropriate investigation and follow the rules of law in order to determine, “have I achieved the point of having a breach? If I have, then I need to give the appropriate notices under the laws that apply.”

In order to learn more about the course that I teach at the SANS Institute, you can click the link below. Also, another link below provides more information about me and my work in private practice.

 

 

Attorney Benjamin Wright helps others navigate the law of technology.

He teaches the Law of Data Security and Investigations for SANS Institute, the premier authority for training information security professionals and digital forensics experts. That 5-day bootcamp is unique in the world.

Wright is author of The Law of Electronic Commerce (Wolters Kluwer) and Business Law and Computer Security (published by SANS).

For more information about how KirkpatrickPrice can assist you in meeting your compliance objectives, contact us today.

Joseph R. Swedish, CEO of Anthem Inc., one of the largest healthcare providers in the US, announced Wednesday, that despite efforts to appropriately safeguard their information, they suffered a major cyberattack. This attack is said to have affected as many as 80 million people.

According to Anthem, this attack compromised both patient and employee information, names, birthdays, medical ID’s, Social Security numbers, street addresses, email addresses, and employment and income information. Swedish said in a letter published on a website about their response to the incident, “Once the attack was discovered, Anthem immediately made every effort to close the security vulnerability, contacted the FBI, and began fully cooperating in the investigation.” (www.AnthemFacts.com) They have since taken measures to improve their security environment by fully evaluating their systems.

HIPAA laws mandate that you properly safeguard the Personally Identifiable Information (PII) that you collect, and data breaches such as this can often result in heavy fines. There are specific guidelines in regards to protecting this information as well as reporting a breach once it has been discovered. In too many cases, businesses scramble to pick up the pieces as a result from a breach rather than already having in place a strong defense to protect the PII for which they are responsible. This is a scary time for the cyberworld, and with the discovery of this massive data breach we should be encouraged to continue to improve and strengthen our security measures as the landscape continually evolves.

If you need help assessing your current security environment or need help developing your Incident Response Plan, call us today at 800-770-2701 for a free consultation.