66
CYBERSECURITY FUNDAMENTALS
STEPS FOR DEFENDING AGAINST RANSOMWARE Known vulnerabilities are one of the most commonly used entry points for ransomware exploits. Once inside, attackers target Active Directory (AD) weaknesses to escalate privileges and propagate code across the organization. One of the most effective ways to stop ransomware attacks is to focus on the fundamentals, such as taking a risk-based approach to vulnerability remediation and regularly ĮĮÐĮĮðĊæ # ÆďĊťæķīĴðďĊĮȘ To help you get started, here are six steps to take for improving your security defenses against ransomware:
STEP 1
SCAN OFTEN, SCAN EVERYTHING More and more ransomware strains are using software vulnerabilities as the initial attack vector with ransomware groups like REvil/Sodinokibi targeting Oracle WebLogic (CVE-2019-2729) and Pulse Secure (CVE-2019-11510Ȩ ŒķăĊĮȘ }ìÐĮÐ ŦœĮ ĴÐĊÌ Ĵď ÅÐ ďăÌÐī ĊÌ œÐăă āĊďœĊș Įď ðĴȸĮ ÐĮĮÐĊĴðă Ĵď ÆďĊĴðĊķďķĮăř ĮĮÐĮĮ řďķī entire attack surface - especially web apps, remote access infrastructure and OT devices - as your environment changes and new vulnerabilities appear.
STEP 2
HARDEN AD TO PROTECT YOUR CROWN JEWELS
Ransomware groups have ditched their custom spreader code used to propagate attacks in favor of a more effective technology already present in organizations: Active Directory. Active Directory (AD) contains the āÐřĮ Ĵď ĴìÐ āðĊæÌďĉ œðĴì ăďæðĊ ÆīÐÌÐĊĴðăĮș ÆďĊťæķīĴðďĊ ĮÐĴĴðĊæĮ ĊÌ ÆÆÐĮĮ ĨďăðÆðÐĮ åďī ăă ķĮÐīĮș ÐĊÌĨďðĊĴĮș applications and servers. You need to ensure that # ðĮ ŒďðÌ ďå ÆīðĴðÆă ĉðĮÆďĊťæķīĴðďĊĮ that would allow attackers to deploy their payload throughout IT systems and end-user devices.
STEP 3
DE-ESCALATE PRIVILEGE ESCALATION
LķĮĴ Į ĊĴðĉăœīÐ ĮďåĴœīÐ ĮÆĊĮ ðĊÌďœĮ åďī ķĊķĮķă ťăÐĮ ĊÌ ĨīďÆÐĮĮÐĮș ðĴ ðĮ ðĉĨďīĴĊĴ Ĵď ĉďĊðĴďī # for unusual activity. With the right intelligence, AD changes, Syslog changes and Windows event logs can be ÆďīīÐăĴÐÌ Ĵď īÐŒÐă ĉðĮķĮÐĮ ďå ĨīðŒðăÐæÐÌ ÆÆďķĊĴĮ ĊÌ ÆĴðŒÐ ĉðĮÆďĊťæķīĴðďĊ ÐŘĨăďðĴĮȘ ķæĉÐĊĴÐÌ œðĴì ĴìðĮ technology, incident response teams can proactively stop ransomware attacks from spreading via AD. Integrate this data with your SIEM to collect information forwarded from the Windows Server event logs and other systems.
STEP #4
PRIORITIZE USING PREDICTION
You cannot patch everythingș ĊÌ ĴìÐ æďďÌ ĊÐœĮ ðĮ ĴìĴ řďķ ÌďĊȸĴ ìŒÐ ĴďȘ }āÐ ÌŒĊĴæÐ ďå īÐăȭĴðĉÐ ĴìīÐĴ intelligence to understand the latest attack paths used by ransomware groups and guide your remediation ĮĴīĴÐæřȘ ķĴ ĴìĴȸĮ ĊďĴ ăăȘ ķăĊÐīÅðăðĴðÐĮ ĴīæÐĴÐÌ Åř īĊĮďĉœīÐ ÐŘĨăďðĴĮ ĴÐĊÌ Ĵď ÆăķĮĴÐī īďķĊÌ ĮĨÐÆðťÆ ĴřĨÐĮ of weaknesses and asset categories. This allows savvy defenders to predict which vulnerabilities will likely be exploited in ransomware attacks and proactively address them before there is a business impacting event.
STEP #5
REMEDIATE LIKE YOUR ORGANIZATION DEPENDS UPON IT
Too often, vulnerabilities targeted for remediation are never fully remediated. While security teams are responsible for detecting and prioritizing vulns, patching them is the responsibility of IT operations and ÌÐŒÐăďĨÐīĮ œìď ĮĨÐā ÌðååÐīÐĊĴ ăĊæķæÐ ĊÌ ìŒÐ ÌðååÐīÐĊĴ æďăĮȘ AĴȸĮ ĉďīÐ ðĉĨďīĴĊĴ ĴìĊ ÐŒÐī ĴìĴ řďķī tðĮāȭÅĮÐÌ ķăĊÐīÅðăðĴř TĊæÐĉÐĊĴ ĮďăķĴðďĊĮ integrate with your ITSM and ticketing systems to automate œďīāŦďœĮș ÆďīīÐăĴÐ ŒķăĊÐīÅðăðĴðÐĮ œðĴì ĨĴÆìÐĮș ĊÌ ŒÐīðåř ĴìĴ ăă ðĊĮĴĊÆÐĮ ďå ŒķăĊÐīÅðăðĴř ìŒÐ ÅÐÐĊ ĨĴÆìÐÌ or remediated by a compensating control.
STEP #6
MEASURE TO IMPROVE YOUR GAME
wķÆÆÐĮĮåķă ĴÐĉĮ ĴāÐ ĴðĉÐ Ĵď īÐŦÐÆĴ ďĊ ìďœ ĴìÐř īÐ ĨÐīåďīĉðĊæș ĊÌ ĮÐÆķīðĴř ðĮ Ċď ÌðååÐīÐĊĴȘ }ìðĮ īÐĪķðīÐĮ developing key metrics to measure and communicate how your operational controls are working (or not working) and benchmarking data to compare performance across internal groups or externally against your peers. Metrics should cover foundational cyber hygiene practices such as your assessment capabilities, remediation speed and overall cyber risk reduction.
HOW TENABLE HELPS
wÐÐ ìďœ }ÐĊÅăÐȘÌ ĨīÐÌðÆĴĮ ĴìÐ ÆĴðŒÐ #ðīÐÆĴďīř ŦœĮ ransomware will leverage to deploy code across your entire organization and detect indicators of attacks in real time.
Speak with us today about your project MORE USLEARN 770-606-8442 | CAN 416-410-5599
sales@complytec.com
MORE INFORMATION
wÐÐ ìďœ }ÐĊÅăÐȘÐĨ ìÐăĨĮ ĨīÐÌðÆĴ A} ŦœĮ īĊĮďĉœīÐ œðăă leverage to disrupt your business and measure how effective you are at addressing them. LEARN MORE