Proudly serving Virginia, Maryland and DC // Call us today! 703.396.6120
V2 SystemsV2 Systems
Understanding and Mitigating Ransomware

by Erik Briceno

Without question, ransomware is quickly becoming the largest threat to cybersecurity and cyber infrastructure worldwide. When it begins to affect vital ecosystems such as hospitals, fuel pipelines and even food production, it’s time to start taking it seriously. And indeed it is now.

What is Ransomware?

Ransomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. In recent years, ransomware incidents have become increasingly prevalent among the nation’s state, local, tribal, and territorial government entities and critical infrastructure organizations.

Why Ransomware is so Dangerous

Ransomware incidents can severely impact business processes and leave organizations without the data they need to operate and deliver mission-critical services. Malicious actors have adjusted their ransomware tactics over time to include pressuring victims for payment by threatening to release stolen data if they refuse to pay and publicly naming and shaming victims as secondary forms of extortion. The monetary value of ransom demands has also increased, with some demands exceeding US $1 million. Ransomware incidents have become more destructive and impactful in nature and scope. Malicious actors engage in lateral movement to target critical data and propagate ransomware across entire networks. These actors also increasingly use tactics, such as deleting system backups, that make restoration and recovery more difficult or infeasible for impacted organizations. The economic and reputational impacts of ransomware incidents, throughout the initial disruption and, at times, extended recovery, have also proven challenging for organizations large and small.

The Importance of Making Offline Backups

It is critical to maintain offline, encrypted backups of data and to regularly test those backups. Backup procedures should be conducted on a regular basis, and it’s important that they be maintained offline since many ransomware variants attempt to find and delete any accessible backups. Maintaining offline, current backups is most critical because there is no need to pay a ransom for data that is readily accessible to your organization.

You should also maintain regularly updated “gold images” of critical systems in the event they need to be rebuilt. This entails maintaining image “templates” that include a preconfigured operating system and associated software applications that can be quickly deployed to rebuild a system, such as a virtual machine or server. Retain backup hardware to rebuild systems in the event rebuilding the primary system is not preferred. Hardware that is newer or older than the primary system can present installation or compatibility hurdles when rebuilding from images.

In addition to system images, applicable source code or executables should be made available — whether stored with backups, escrowed, obtained from license agreements, etc. It is more efficient to rebuild from system images, but some images will not install on different hardware or platforms correctly. Having separate access to needed software will help in these cases.

Responding to System Vulnerabilities

V2Systems Understanding and Mitigating Ransomware September2021 Blog1 Pic2 1024x683 - Understanding and Mitigating RansomwareIt’s vital that organizations create, maintain and exercise a basic cyber incident response plan — and associated communications plan — that includes response and notification procedures for a ransomware incident. They should also conduct regular vulnerability scanning to identify and address vulnerabilities — especially those on internet-facing devices — to limit the attack surface.

Patching of course is an absolute necessity. Regularly patch and update software and OSs to the latest available versions and prioritize timely patching of internet-facing servers. Don’t forget to include software that processes internet data, such as web browsers, browser plugins and document readers.

Finally, ensure devices are properly configured and that security features are enabled. Employ best practices for use of RDP and other remote desktop services. Threat actors often gain initial access to a network through exposed and poorly secured remote services, and later propagate ransomware.

All of this might seem overwhelming, but V2 Systems offers the tools and manpower required to deal with the threat of ransomware. We’ll deal with the threats, so you don’t have to. Don’t be held hostage.

 

Since 1995, Manassas Park, VA-based V2 Systems has employed local systems administrators, network engineers, security consultants, help desk technicians and partnering companies to meet a wide range of clients’ IT needs, from research, to implementation, to maintenance. Concentrate on your VISION…We’ll handle the TECHNOLOGY!

ebriceno
About ebriceno
Erik Briceño is the owner of V2 Systems, Inc., one of Northern Virginia’s leading Information Technology Managed Service Providers. He is an inspiring leader for its employees and instrumental business partner for its customers. He is passionate about V2’s purpose, dedicated to exceeding expectations and a consummate professional not afraid of jumping in and getting his hands dirty. Prior to joining V2 Systems in 2002, Erik was a co-founder and COO of Ampcast.com, a leading provider of online resources servicing over 5,000 independent musical artists. At Ampcast.com, Erik spearheaded all aspects of corporate development, funding, strategic vision, and business development for the firm. From 1997 to 1999 Erik held the position of Acoustic Systems Engineer for Electric Boat Corporation, a leading defense contractor. In this role, Erik was responsible for the acoustic fidelity of two noise critical systems and components in the US Navy’s nuclear submarine systems. Erik holds a B.S. in Mechanical Engineering from Vanderbilt University and a Masters of Business Administration from George Mason University. When not working, you will find Erik a dedicated family man, raising two young children with his lovely wife Karen. Together, they enjoy building legos, playing baseball, skiing, riding horses, swimming, traveling, and fixing up old Mopars.
Understanding and Mitigating Ransomware
Understanding and Mitigating Ransomware