The newest attack impacted servers across Italy. At its peak, traffic was reduced to 26% of normal levels across the country. Servers in France, Finland, the United States, and Canada were also affected. The French cybersecurity agency, ANSSI, which issued the first alert on Friday, warned of continuing attacks against vulnerable servers in the days to come, and reiterated its guidance to administrators to patch their affected systems.

So, in case we’re keeping score, here’s where we’re at:

• VMware identified a weakness in its products 2 years ago.
• The company released a security update almost immediately, along with an advisory letting customers know they needed to download and install it.
• National cybersecurity agencies in Canada, the U.S., and elsewhere issued similar advisories and linked to the VMware download.
• 22 months later, VMware issued another advisory – meaning not everyone had applied the update.
• Within weeks, the yet-to-be-identified cybercriminals behind this attack pounced. They knew about the weakness, knew that large numbers of servers in Italy and elsewhere had not yet applied the update, and they targeted the weakest links in much the same way lions go after the weakest prey.

In short, this attack happened because the easy fix was ignored on a shockingly large scale. Whoever was responsible for the affected servers in the affected countries failed to download and apply a small piece of free software. In doing so, they left the virtual front door wide open for a couple of years.

This isn’t an exercise in finding fault. We get it: IT isn’t easy. And the cybersecurity competency is even harder to figure out. The threat landscape continues to intensify just as demands from the business – whatever business that happens to be – become more complex and mission-critical.

Worse, the techies must keep the lights on while simultaneously keeping the bad guys at bay – at a time when IT budgets are being increasingly scrutinized amid overall pullbacks in business spending.

The pandemic has pushed IT to, and sometimes beyond, the limit, forcing it to support virtual and hybrid workforces, deploy sophisticated customer-facing e-commerce capabilities, and wrestle with economic uncertainty and supply chain mayhem. In the rush to keep the lights on throughout the pandemic, established protocols and best practices may have been skipped along the way – leaving the organizations they serve dangerously exposed. 

A TOUGH SELL

Cybersecurity, for too long, has been a difficult line item to justify in the budget. Like insurance, we tend to ignore its importance until we’ve been digitally compromised. Even still, it is becoming even more of a tough sell. Unlike the shiny new piece of hardware or the massive new building, cybersecurity doesn’t generate the same kind of visceral excitement among those who pay the bills.

Data from JumpCloud reinforces the uphill climb IT now faces, with 44% of IT professionals reporting their organizations will reduce their cybersecurity spending in 2023. Three-quarters of respondents say these cuts will put their organizations at greater risk, and just over half – 58%, say their current security position has worsened over the past year.

They say all this is largely due to the tight labor market, inflation, recessionary fears, and global conflict. Which is likely plausible – but is hardly an appropriate excuse. The sad reality for IT leaders is stark: reduced cybersecurity spending provides the perfect fuel for an explosion in cybercriminal activity. Cutting corners on cybersecurity preparedness is the worst kind of IT math that could very well destroy the business. 

CREATIVITY TO THE RESCUE?

As cybersecurity spending falls behind fast-evolving and expanding needs, IT professionals are left to do their best to keep up. More often than not they manage to keep everything together, often through the sheer forces of creativity and will. But sometimes they end up dropping the ball on mundane operations like security patches and updates. And this global-scale attack is a perfect example of what happens when they fail to keep up.

Applying security fixes in a timely manner slams the door on opportunistic attacks like the one that darkened Italy for much of the day. As ever, human nature, more than any one technology, is what makes us more vulnerable than we need to be. It also explains why attacks seem to be getting bigger, more damaging, and more frequent: because cybercriminals are getting better at identifying who isn’t keeping up and are learning how to choose the most opportunistic targets for ever more impactful cyberattacks. 

THE BOTTOM LINE

The Italian ransomware attack should sound the alarm across all geographies – as well as all governments, corporate leaders, and regular folks alike – that cybersecurity has been an underserved competency for too long.

As organizations continue to evaluate their technology priorities amid an ever-shifting economic landscape, they must examine their cybersecurity spending priorities through a new and more urgent lens. Shaving cybersecurity budgets won’t represent much of a saving after a successful ransomware breach brings the organization to its knees and permanently damages its brand.

The Italian attack proves this risk is more real now than it’s ever been.  And we can start by double-checking whether or not we’ve applied every outstanding security patch and fix. It’s the least we can do. 

The post Italian ransomware attack highlights bad patch management first appeared on STEP Software.

After millions of workers worldwide were sent home following the first wave of lockdowns in March 2020, cybercriminals shifted gears. Amid the chaos of those early days, as corporate IT focused on keeping remote workers productive, ransomware attacks skyrocketed, with the FBI reporting a 62% increase in ransomware reports in the first half of 2021 compared to the same year-ago period. This follows a 20% increase in 2020.

None of this came as any surprise to those of us in IT; the pandemic opened the door and malicious actors were only too happy to walk through. Workers were figuring out how to use new-to-them collaboration tools like Zoom, Microsoft Teams, Cisco WebEx, and others. Vendors were struggling to introduce new features that better replicated the rich collaborative landscape of their now-shuttered office spaces. Business leaders straddled the precarious line between privacy and productivity, all while keeping virtual offices open.

Thanks to all this chaos, new security vulnerabilities were being discovered daily. And all this was playing out across the same home networks that the kids were using to stream Netflix, play video games, and share TikTok videos and do school online.

Security wasn’t exactly everyone’s priority, and cybercriminals picked up on it. Most ransomware attacks, like the Colonial Pipeline event, which resulted in fuel shortages throughout the Eastern Seaboard, and the JBS Foods attack,  which limited meat supply across the U.S., start with a targeted phishing campaign against employees. With businesses having limited access to effective training resources to combat this rising threat, end-users represented the weakest link in the chain, and easy pickings for opportunistic digital criminals.

TIME TO GET CYBERSECURITY-SERIOUS

Almost two-and-a-half years into this global crisis, employers – and their home-based workers – must shift from a reactive mode to proactive model. This paradigm shift is necessary to protect themselves and their companies from the increasingly challenging threat landscape. With hybrid work becoming more commonplace, employers and their workers have a responsibility to STEP up their cybersecurity game. Whether you’re working from home full-time or have shifted into a hybrid arrangement, it’s up to you to protect yourself and your employer as if your job depended on it. Because it just might.

With remote and hybrid workers now representing the front line of defense against increasingly sophisticated cyberattacks, these straightforward changes can go a long way towards keeping you and your employer, from becoming the next major headline:

1 – Use email and messaging apps more wisely

Most ransomware attacks begin with a message that looks like it comes from a legitimate source – like your VP, or IT team, or a client – but in reality, it does not. Get into the habit of not responding on touchscreen devices like smartphones or tablets. Instead, wait until you’re back at your laptop or desktop PC, then use your mouse to hover over the message header information. Look for anomalies – like extra or missing letters or fake domains – in email addresses and URLs. Do not reply to suspicious messages and never click on links or buttons, either. Dispense with the notion that we need to respond to every message we receive.

2 – Smarten up your passwords

Weak password protocols and habits can significantly expose you and your organization to an attack. Update your password game with new, strong, unique passwords on all your corporate and personal accounts. Never use the same password for more than one purpose. Instead, use unique passwords for each app, website, or service. Never use an easily guessed password, like a pet’s or a partner’s name. Change them often, at least quarterly but ideally, monthly. Use strong passwords – mix in upper and lower-case characters, as well as numbers and special characters. Even better, use pass phrases, as they can be even more difficult to crack. Use a password manager if you’re having trouble managing them all – because as much of a hassle as it is to be password-safe, it’s an even bigger hassle to recover from a cyberattack.

3 – Update your devices and apps

Cybercriminals just love targeting devices whose software hasn’t been updated in a while, as they lack critical security patches and fixes and are consequently that much more vulnerable. For any internet-connected device on the same home-based network that’s also being used for corporate work, make sure you’ve updated to the latest version of the operating software or firmware that runs it. Do the same for your apps and your browser.

Pro Tip: Turn on auto-update for all your devices, apps, and browsers to minimize your exposure to fast-emerging threats. Check with your IT department to ensure they’re keeping corporate-deployed hardware maintained from their end, as well.

4 – Set encryption to kill

Encrypted data is like the secret decoder rings of our childhood: bad guys can’t read it unless they have the ring. To them, it’ll be gibberish. Use a virtual private network – VPN – to encrypt all traffic on all devices. Many devices, apps, and services now have encryption built into the settings – all you have to do is turn it on. If all of this sounds like gibberish to you, reach out to IT to ensure they’re applying the latest levels of encryption to all devices and apps that you’re using to get work done.

5 – Tighten authentication

If you aren’t using two-factor authentication (also sometimes referred to as 2FA, or multi-factor authentication/MFA) stop what you’re doing and activate it now. It ensures that even if your password is compromised, there’s another layer of security – like a fingerprint or facial scan – to go through.

6 – Check file extensions carefully

Ransomware attacks often originate with infected email links – and clicking on those links could unleash enormous damage to the corporate network. One of the best ways to protect against this type of attack is by getting to know which file extensions are most likely to harbor malware and other threats. If you receive a link with the file extension .VBS, .EXE or .SCR, do not click on them. Instead, check with the IT team, as these executables could be carrying dangerous payloads. Pay close attention to Microsoft Office extensions, like .DOCX, .XLSX, or PPTX, as well, as they, too, could contain automated scripts that, upon being clicked, infect your device with malware.

7 – Stop oversharing

Revealing too many details about yourself – both on social media as well as across email and other messaging platforms – could make you a prime target for cybercrime. Review your profile information on all your public-facing accounts. Set limits on who can see what you post – but remember that nothing is every truly private online. Get rid of old posts that might contain private or sensitive data that cybercriminals could use in a potential attack. Scan your friends and followers and get rid of questionable connections.

8 – Get to know your IT team

When we all worked in physical offices, it was easy to wander over to the IT team whenever we had a problem. With the rise in remote and hybrid work, those face-to-face interactions aren’t always possible, and the cyber criminals know that. One of the most insidious forms of cybercrime involves the impersonation of IT workers. Connect with your team virtually and discuss current protocols for how IT connects virtually with employees, and the resources they’ve put in place to ensure no one ever successfully impersonates them. Make sure you’ve reviewed and signed off on corporate policies around acceptable use of technology, and cybersecurity best practices. It’s there for the taking – but we’ve got to review and understand the rules.

Working from home can be both productive and freeing, but it also opens the door to fast-evolving cyberthreats. As cybercriminals increasingly target at-home workers, it has never been more important to ensure your behaviors aren’t exposing you and your organization to unnecessary risk. You rely on your employer for your paycheck, and the last thing you want to do is be responsible for the next ransomware attack.

The post Ransomware and remote workers: 8 tips to stay safe first appeared on STEP Software.

Malicious software is used to deny access to data or systems until or unless the attacker’s ransom demands are met. Methods for delivering the malware payload vary, with the three of the most common being phishing emails, exploitation of application vulnerabilities, and delivery via remote desktop protocol (RDP). The use of phishing emails as an attack vector is currently on the rise.

Once successfully delivered, the malware propagates across data storage environments and/or vulnerable systems, rendering systems and data inaccessible. Attackers then demand ransoms in exchange for restoring access. If the demands are not met, and sometimes even if they are, access to systems may remain blocked. Your data could be deleted or remain unavailable as a result of having been encrypted using the attackers’ algorithms.

HARDENING THE ENVIRONMENT

Following are recommended strategies to thwart ransomware attacks:

• Back up your data. It’s critical to protect your encrypted data frequently. Use an offline repository, or air-gapped, storage system so that even if your backup is compromised, the hacked data is useless. Be sure to retain multiple sequential version backups so that pre-attack files will be available for restoration. Another solution that is becoming more popular is to use a secure cloud storage service for your backups. Typically, cloud storage providers offer data encryption and system redundancy to ensure that you are able to quickly and efficiently restore your files in the event of a successful attack. Verify that your cloud backup provider has versioning capabilities that would allow files to be restored to their pre-attack state even if post-attack cloud backups are performed.
• Create and regularly maintain golden images of your critical systems so that, if the attackers deprive you of access to those systems, they can be rebuilt as quickly as possible. Create and maintain templates with operating systems that are pre-configured to expedite the process of reloading systems. Have copies of your application software on hand as well. Also, make sure to have vendor support contact information readily available for all hardware and software.
• Regularly install patches and security updates. Create a policy that establishes requirements and schedules for doing so, and ensure that your system administrators are familiar with and adhere to these requirements.
• Limit administrative permissions among users and restrict the installation of unapproved applications within your environment. Ransomware may initially be installed locally when a user clicks a link in a phishing email or connects to an infected system via RDP, then propagate across the network.
• Perform analyses, make plans, and test your plans regularly. Some of your systems may be more critical than others. Perform business impact analyses to identify and prioritize these and ensure they receive prompt attention should an attack occur. Use this information, along with input from your key personnel and any lessons learned from previous incidents, to develop incident response and business continuity plans. Include 24/7 contact information for members of your response team. If you need guidelines to get started, organizations like the National Institute of Standards and Technology (NIST) and its Canadian counterpart (which can be found here: NIST Launch Page) provide sample plans and best practices. Once you’ve put your procedures in place, test them periodically. Continuously improve them based on lessons learned through your testing and actual incidents.
• Train your employees regularly and ensure new hires receive security training. Technical controls cannot prevent all attacks. Your staff should be trained to identify potentially malicious emails, to avoid clicking links in suspicious messages, and to refrain from providing certain types of sensitive information about your organization via written or oral communications. They should also be prohibited from installing unauthorized applications (if, based on their job requirements, their privileges to do so cannot be restricted) and from remotely connecting to external systems without authorization. Providing an ongoing training program that educates your employees regarding current attack vectors and threats is essential. Your employees are your last line of defence.

RESPONDING TO A SUCCESSFUL RANSOMWARE ATTACK

If your organization is successfully attacked, execute your incident response and business continuity plans immediately to begin the process of restoring your data and/or system access, thereby minimizing the attack’s impact. As soon as possible, report the incident to your local law enforcement office or, in the United States, via the FBI’s online cybercrime reporting site at tips.fbi.gov/.

Before paying any ransom, consider the following:

• The experts at the U.S. Cybersecurity and Infrastructure Security Agency (CISA) do not encourage organizations to pay ransoms.
• Paying the ransom does not guarantee that your access will be restored. Remember, you are dealing with a criminal. Some organizations that have given in to attackers’ demands have never had their system access restored or been given the keys to unencrypt their data.
• Attackers sometimes demand additional payments after receiving the initial ransom.
• Some victimized organizations that did pay have been subsequently targeted in new attacks because they have exhibited a willingness to comply with attackers’ demands.

SUMMARY

Ransomware is a growing threat that utilizes multiple attack vectors. Unless your organization has prepared for an attack by securely backing up your data, hardening your systems, educating your employees, and developing response plans and continuity procedures, you may find that you are unable to resume normal operations for an extended period of time, if at all.

Giving in to an attacker’s demands does not guarantee that access to your systems and data will be restored. In fact, paying a ransom may only result in additional demands by the attacker, or in your company being targeted in future attacks. Taking the necessary steps to create a solid plan to help you prepare for and respond to a ransomware attack could be key to your organization’s survival.

The post Is Your Organization Prepared for a Ransomware Attack? first appeared on STEP Software.