Cybersecurity: What is Ransomware Tutorial and how to protect your company from malware threats.
Cybersecurity: What is Ransomware Tutorial and how to protect your company from malware threats.
The rapidly changing landscape for business has changed cybersecurity dramatically. The shift to remote and cloud-based work has meant that employee identities and devices are no longer behind the locked and monitored perimeter, providing the perfect beachhead for attacks. This is a key reason ransomware attacks have grown exponentially, and it’s now estimated that a new ransomware attack takes place every 11 seconds in 2021. (FBI)
While ransomware has gained everyone’s attention, these types of malware only represent between 5% to 21% of all malware attacks. Malware, or malicious software, is any piece of software that was written with the intent of harming systems, organizations, or people. Types of malware include computer viruses, trojans, spyware, ransomware, adware, worms, file-less malware, or hybrids of the above.
Ransomware has managed to achieve our attention and celebrity status among malware because it represents the modern-day bank heist. Ransomware encrypts a victim’s files, and the attacker then demands a ransom from the victim to restore access to the data upon payment. The costs can range from a few hundred dollars to thousands and are usually payable to cybercriminals in Bitcoin to avoid detection. The estimated cost of ransomware to business in 2021 is $6 Trillion annually.
There are many vectors ransomware can take to access a computer. One of the most common delivery systems is phishing spam, where attachments come to the victim in an email, masquerading as a file they should trust. Once downloaded and opened, they can take over the victim’s computer, especially if they can gain administrative access through social engineering or an abundance of system exploits. From there, the ransomware gang will continue to hack your systems and applications until they take control over mission-critical systems and data.
Ransomware authors have been getting increasingly sophisticated in their ability to collect ransoms. They do not rely on automated pieces of code but manually hack systems and networks until they get the right level of access and the data. They will impersonate law enforcement, suppliers, and software vendors. They will delete or infect your backups. They even have support channels to “help” the victim purchase bitcoins and pay the ransom to release the system or regain access to critical data.
How to avoid Ransomware?
The sophisticated nature of malware evolution creates a pervasive sense that it’s somewhat hard to prevent attacks. Two standard anti-malware solutions tend to be deployed as a defense. The first is the old-fashioned 90’s Norton Antivirus style of software that uses signature-based detection.
In other words, we know about this particular virus or malware, so we add it to the signature database, and we keep adding new signatures every time a new virus crops up. Sometimes different signatures will expire because they become old, and sometimes, expired viruses come back in a more dangerous configuration.
These signature style detections are fine, except they only detect things that have already been discovered and analyzed by the anti-malware vendor. In other words, somebody else got infected, and their whole network was destroyed before we learned to add that virus signature into our signature database. The problem with this strategy is that there are at least 560,000 instances of new malware being created and detected each day, making anti-malware a weak defense strategy alone.
The second approach is more defensive by nature and has two variations. The first works on protecting the technical environment so that a malware detonation doesn’t impact everything, typically by sandboxing systems internally. This approach separates systems by compartmentalizing everything so that your system can’t be severely damaged when malware goes off.
This approach does work in many cases, but it is challenging to compartmentalize everything, and there are often compatibility and execution issues during implementation and management with this approach.
The second category is a more advanced anti-malware solution based on behavioral detection heuristics algorithms that identify behaviors that likely indicate malware activity in general. This is a pure heuristic behavioral detection approach where the anti-malware software is looking for things that malware would do, like attempt to gain kernel access or system privilege, write data in a certain way, or execute processes. It will proceed to terminate the suspected malware before it can do any damage. The problem with that is a lot of our regular applications also do those things, but only occasionally, so it’s challenging to fingerprint what activity is legitimate and what is malicious.