Ransomware: Can you protect against attacks?

Editor's Notes

• #2: Welcome and thank you for joining me today I am Mark Warren and I’d like to present today about the growing challenge of Ransomware and how organisations should protect themselves against attacks and be prepared to recover after an attack.
• #3: Let’s start with a question. How many organisations do you think have suffered a ransomware attack? Less than 50%? 75%? Higher?
• #4: Recent independent research commissioned by Osirium threw out some surprising numbers. Nearly 80% said they’d been attacked with 68% saying the attack was in the last 12 months.
• #5: Cyber attackers were definitely not on furlough over the last 18months and if anything changes to working practices, such as remote working, has aided Cyber criminals to impact even more organisations and make more money. This has impact has been across all businesses, but there has some significant cases showing a possible new trend to attack the supply chain: the providers of managed services or software suppliers. Solarwinds was probably the most high-profile. There the attack took a very sophisticated route into the solarwinds software build systems and infected firmware that was then deployed to thousands of network devices around the world. It’s no wonder these attacks are attractive: With one attack on an MSP or software supplier, hundreds or thousands of organisations can be infected and become potential ransom-payers.
• #6: So, really, it’s a question of WHEN you will be attacked, not IF so you really need to be prepared.
• #7: In this session, I’m going to take a look at what is probably the most common attack journey – how the ransomware gets into an organisation and then how it develops to ensure maximum damage and highest possibility of ransom payment. I’ll also look at how prepared or unprepared most organisations are, and why they may not be ready. Finally, I’ll wrap up with some examples of how protection can deployed without impacting the business.
• #8: Why am I talking about this and why Osirium? We are a UK Based Cyber Security software company that provides solutions that protect organisations against the threat of malicious and accidental misuse of Privilege credentials We have some great customers in the UK and internationally, ranging from small non-profit organisations to global financial services.
• #9: Let’s start with looking at a typical attack journey. Almost all attacks start with some software arriving with at a user within the business. Most users have limited powers to make significant impact on the business if they are attacked. That’s why malware is always looking for chances to elevate its privilege level – to become some kind of “administrator” that has the potential to do maximum damage. That’s why its estimated that 80% of all breaches involve privileged access – I suspect it’s actually higher. You could think of this as elevating privilege to maximise the potential blast radius of an attack. A user may cause limited damage, but an administrator with root access to a critical server or a domain administrator can bring the entire organisation down. Let’s look at an example of how that happens.
• #10: This is a very simplified example, but it shows the main concepts that I want to highlight. We probably already know the most common entry points to attacks is via the people in the business. Even with good training, the attacks are so sophisticated that it’s easy to click on a bad link in an email, open an infected document or download an infected software installer.
• #11: Once that unfortunate click is pressed, the attack is in progress and that workstation is infected. In most cases, it’s not visible. The malware sits in wait, looking for more interesting and valuable content and accounts. It may lay in wait for weeks or months before becoming active.
• #12: But, the attack may start exfiltrating some data, including that user’s credentials. Those credentials could be useful later, but they may also be the gateway to other attacks, Sadly, human beings are not good with passwords. Far too often, they’re too simple or reused – the common themes of pets names, birthdays etc. may be easy to remember but they also make it easy for hackers to brute force your accounts on other systems.
• #13: The attack will be looking for opportunities to spread. For example that infected software download, say freeware drawing package, or an infected document, may get copied to a shared file server where it’s ready to be picked up by other, unknowing victims. Of course, even at this point it may find valuable data or accounts. People often forget the value of their data spread around the organisation like this. It could be documents with customer lists, it could be IP such as source code, or product designs. It could even be – and this is the real nightmare, but sadly real - a spreadsheet containing admin account names and passwords! All valuable assets to be exfiltrated out of the business. And this is all before the ransomware has kicked in.
• #14: Once that document or file is available, even the most experienced admin could fall victim. Perhaps they see that someone has already downloaded the updated app they wanted or they open that infected document.
• #15: Once the attack has infected the admin workstation, it can now collect the admin level credentials to elevate its privileges and start going after the really interesting systems and data.
• #16: Of course, before doing much more, those credentials and admin content gets exfiltrated because they could be really valuable on the black market.
• #17: Of course, that admin has privileged access to valuable systems – that’s their job..
• #18: Those devices could the hypervisor for your virtual machines. That doesn’t sound too bad, but those VMs could be running your VPN, your firewall, your domain controller, … or any number of critical services and applications. It could be your Domain Controller or Active Directory server. Once the attack has that access, it remove, change or delete accounts, it could push malware to be installed on every laptop or device across the business. Another key target could be your backup management system. Once the attack gets the admin account credentials for your backup management system, such as Veeam, Commvault, etc, it can change backup schedules, or even get access to the backup files themselves ready to delete or infect the backups.
• #19: Once those backend systems are infected, we see the same stealing of content and credentials But the attack will continue to lie in wait. Smart attacks wait weeks to ensure that infected files from user’s workstations or other servers are backed up – preferably through all the backup levels, even those snapshots taken offline.
• #20: Eventually, the attack goes live and the nightmare really starts. It’s at this point you find out just how good your recovery plan is and just how damaged all your systems and backups are.
• #21: One slightly surprising result from the Ransomware Index report, was just how willing people might be to pay a ransom rather than invest in improving defence and prevention systems. Some people may take the same attitude as they do with insurance – we’ll pay the cost if it’s ever needed. As we saw before – it’s not a question of “if” but “when” an attack will happen, so this is a short-sighted view. Some might assume that they outsource some or all of their IT and assume their MSP will sort out the mess. As we’ve seen, those MSPs can be a target, but the Index also found that only 43% of businesses with at least some outsourced IT had formal requirements for ransomware protection in their service agreements. Finally, they may be assuming that protection is expensive or even not feasible.
• #22: To some degree, that’s understandable. Protection can be very complicated. Let’s look at those Admin accounts that are the crown jewels for attackers. In the past, there might have been a limited set of admins, all within the IT team. Today, that’s not the case. Not only are there more admin roles in IT, but there are admins across the business: the web master in Marketing, the CRM admin in the Sales team, the HR manager, and many more …
• #23: To make things worse ransomware is getting easier to build and deliver. Why? Because it’s easy, it’s high volume and it’s quick…. There’s no handling of stolen goods, it’s just straight to the money…. and the untraceable nature of crypto currency means the likelihood of being caught and prosecuted is virtually zero. The cyber criminal experts have even learnt from big-business and even offer Ransomware as a Service. Even the ransom negotiation can be outsourced and provided as a ”managed service”. The scale of Ransomware is almost beyond belief. Nearly 900,000 new variants of ransomware per day! No wonder Anti-virus and perimeter protection can’t keep up and successful ransomware attacks are continuing to happen and make the new headlines. A worrying trend is that the cyber criminals know that a successful attack has 2 potential outcomes. You pay the ransom OR you recover to a backup…. But those backups are a critical part of the recovery plan for most so anything the attacker can do make recovery harder, the more the ransom demand looks attractive.
• #24: Some good and bad news from the Ransomware Index. People understand how critical backups are to their ransomware recovery plans – 96% agreed. What’s not so good is that not enough is being done to protect those backups. Although there is a high adoption of techniques such as offline backups – but remember what we’ve already seen they are a prime target – the most fundamental protection is not being addressed. That is protecting access to those privileged admin accounts used for the backup management system or to the servers hosting the backups. This is a fundamental capability – and its required for every element of your cybersecurity strategy. After all, if you can’t protect the admin accounts on your anti-virus, firewall, DLP tools, or anything …. Then really you’re leaving the keys to your kingdom in the door inviting an attack.
• #25: It’s not just me saying that. Last year, and again earlier this year, the UK’s NCSC issued guidance to all businesses and public sector organisations to protect against malware and ransomware attacks. They were very explicit about the need for backups and to protect those backups with privileged access management – usually known as PAM. Based on this, NHS Digital made additional funding available to NHS trusts at the start of the year to invest in PAM. I’m very happy to say, that over 30 NHS trusts took up the offer and chose Osirium to build their PAM protection.
• #26: Let’s see how PAM, and related technology, protects against ransomware attacks. You’ll remember this nightmare scenario of the infected organisation. Let’s break it down to look at what protection is needed where.
• #27: We’ll start with that entry point for an attack – the regular users. In far too many organisations, users have been granted local admin rights. There’s a good reason for that – if they need to update software or configuration, for example, IT don’t want to have to deal with every small request because they’re already over-worked. That means the user is happy and the help desk can focus on more valuable work, Unfortunately, it means they can install that infected app or click on the dodgy link. The solution is to allow managed access to local admin rights without opening up the whole system. With Osirium’s Privileged Endpoint Manager, IT can define policies to allow users to run specific, approved applications with elevated privilege – you’ve probably seen the UAC pop-up dialog in Windows when installing something – but only approved apps with a known fingerprint can be elevated preventing the infected malware attack. The user can get on with their work, and IT don’t see a flood of new help tickets. On the backend, Privileged Access Management, like Osirium PAM, protects those admin accounts on vital IT systems like hypervisors, domain controllers or backup systems. Because the admins never have access to actual usernames and passwords to access those systems and services, they cant be leaked to an attacker. PAM takes the key out of the door, to continue my earlier metaphor.
• #28: PAM has many other benefits. The key capability is that it ensures only the right people have the right level of access to the right services and the right time and only for the time it’s needed. That’s a fundamental requirement of any least privilege or zero trust strategy. But with PAM, there are many other benefits. The organisation now has visibility and control over those privileged accounts – who has access, when can they access, monitor what they’re doing and so much more. It also makes it much easier to show compliance with standards that need active privileged account management such as Cyber Essentials, ISO27001, PCI and many more.
• #29: Managing access is only the start. The next level is to manage what people are doing while they have access to a system with privileged access. That’s where automation comes in. Osirium’s Automation lets you build workflows for almost any IT or business process that needs to use administrator accounts such as user account management, firewall updates, the list is endless … It’s simpler than RPA, it’s more secure than traditional scripting and it means that IT jobs that normally need a valuable expert can be safely delegated to the help desk or first line engineers.
• #30: If you’d like to know more, please visit the Osirium stand at C50. You can also hear about a special promotion we’re running at the moment, where you can get started with PAM, including Automation, for less than £5,000 including 3 years’ support.
• #31: I wanted to thank you for your time and share some quotes from some of our customers I look forward to speaking catching up with you on our exhibitor stand or please reach out to me with these details….. Any questions? Thank you.