Ransomware is a form of malware that encrypts a victim’s files and demands payment in order to restore access. It has become an increasingly serious cyber threat in recent years. So what is the best solution to defend against ransomware attacks?
What is ransomware?
Ransomware is a type of malicious software (malware) designed to deny access to a computer system or data until ransom is paid. It works by encrypting files on a victim’s computer using cryptography, making them inaccessible until the ransom is paid. Once installed, ransomware displays a message demanding payment to decrypt the files within a certain timeframe. If the ransom is not paid, the files remain encrypted or may be deleted. Ransomware is typically spread through phishing emails, infected software apps, fake updates, and compromised websites.
What are the different types of ransomware?
There are several major families or types of ransomware:
- Locker ransomware – Locks the victim out of the operating system or computer.
- Encrypting ransomware – Encrypts files and data on the computer.
- Master boot record (MBR) ransomware – Encrypts the victim’s master boot record.
- Web-based ransomware – Encrypts browser data and locks out web access on the infected system.
- Leakware or extortionware – Exfiltrates sensitive data from the victim’s computer before encrypting the files.
Some of the major ransomware families include REvil, Conti, Ryuk, Maze, Sodinokibi, LockBit, CrySis, Dharma, and others. The most sophisticated ransomware is capable of using strong encryption algorithms to lock files and spreading across networks via security vulnerabilities.
What are the consequences of a ransomware attack?
The impact of a ransomware attack can be severe on individuals, businesses, and organizations:
- Loss of access to critical data and systems
- Disruption to business or operations
- Financial losses from data recovery costs
- Reputational damage and loss of customer trust
- Legal and regulatory consequences of data breach
- Payment of sizable ransom demands
In addition to encrypting files, ransomware can delete Volume Shadow Copies making recovery more difficult. Some ransomware variants also steal data before encrypting. This exfiltration of data can lead to exposure of trade secrets, customer information, and other sensitive data.
What is the average ransomware payment?
According to cybersecurity firm Coveware, the average ransomware payment in Q3 2022 was approximately $236,000, double the average payment in Q3 2021. However, ransom demands can range from a few hundred dollars to millions of dollars. The highest ransom demands come from ransomware groups attacking major enterprises, critical infrastructure organizations, and public institutions.
Many ransomware operators now auction data stolen from victims, which further increases pressure on organizations to pay hefty ransoms. Payment of ransoms also does not guarantee restored access or prevent data leaks.
What are the best ways individuals can protect against ransomware?
Here are some key best practices individuals should follow to protect against ransomware:
- Keep your operating system, software, and applications up-to-date with the latest patches and security updates
- Exercise caution with emails, attachments, pop-up windows, and hyperlinks. Do not open attachments or click links from unknown sources
- Use antivirus software and keep it updated
- Backup critical files regularly and keep backups offline or immutable to prevent encryption
- Enable macro security features in Microsoft Office to block unauthorized macros
- Avoid downloading software or apps from unauthorized sites
- Use strong, unique passwords for all accounts and multi-factor authentication when possible
- Keep informed about the latest ransomware threats and risks
Following cybersecurity best practices makes it much harder for ransomware to take hold and encrypt files. Offline, immutable or cloud backups provide the ability to restore files without paying the ransom. Backups should be regularly tested for integrity and recovery.
What are the best ways for businesses to protect against ransomware?
Business ransomware protection should include a defense-in-depth approach with security layers:
- Educate employees on detecting phishing attacks and suspicious activity
- Keep all software and systems patched and up-to-date
- Use endpoint detection and response (EDR) tools to block file encryption
- Deploy anti-ransomware software specifically designed to stop ransomware
- Utilize next-gen antivirus with behavior monitoring or whitelisting capabilities
- Back up data regularly and keep recent backups offline and immutable
- Restrict execution of macros, scripts, RDP, and limit privileges
- Segment and segregate networks to limit ransomware spread
- Disable Remote Desktop Protocol (RDP) if not required or limit access
- Use completely up-to-date network firewalls
A proper incident response plan is also essential for effectively responding to ransomware attacks. This helps businesses to quickly isolate infections, restore from backups, and determine if any data was exfiltrated.
Are ransom payments recommended?
Paying the ransom is generally not recommended by law enforcement and cybersecurity experts for the following reasons:
- There is no guarantee files will be recovered after paying ransom
- Paying encourages more ransomware attacks
- Ransomware operators may still leak or sell data despite payment
- Funds may encourage criminals or fund other illicit activity
- Payment could violate cyber insurance policy or laws prohibiting payments
However, for businesses experiencing significant operational impacts, there are circumstances where paying the ransom may be considered or negotiated. The FBI and cybersecurity experts can sometimes provide support with ransom negotiations.
What other options exist beyond paying the ransom?
If paying the ransom demand is not feasible, organizations do have other options:
While resource-intensive, these alternatives mitigate rewarding criminal extortion and prevent funding additional cybercrime activity.
What cyber insurance policies cover ransomware?
Many cyber insurance policies cover certain costs related to ransomware attacks such as:
- Extortion payments – The ransom payment itself, often with limits
- Restoration – The cost of recovering and restoring encrypted data
- Business interruption – Lost income and profits from disruptions
- Forensics – Investigating the attack’s root cause
- Notifications – Notifying impacted individuals
However, coverage varies widely by carrier in terms of payment limits, deductibles, exclusions, and insured costs. Policies with higher premiums tend to provide more comprehensive ransomware coverage.
What cybersecurity measures are recommended to prevent ransomware?
Recommended cybersecurity measures to prevent, detect, and mitigate ransomware include:
- Employee education – Train staff on ransomware risks and phishing
- Email security – Block dangerous file types and scan all attachments
- Vulnerability management – Patching vulnerabilities to remove infection vectors
- Segmentation and ACLs – Limit lateral movement across networks
- Next-gen antivirus – Detect ransomware behavior with advanced analytics
- EDR tools – Block malicious encryption behaviors
- Backups – Maintain regular backups with versioning and immutability
- Access controls – Limit users through least privilege and MFA
- Incident response plan – Prepare a formal response plan for infections
Layered protections spanning email, endpoints, networks, cloud environments, access controls, and backups make organizations highly resilient to ransomware attacks.
How can organizations practice and test ransomware response?
Ransomware response should be tested regularly through exercises such as:
- Tabletop exercises – Discuss and walk through a simulated ransomware response scenario
- Technical exercises – Run technical response procedures in a test environment
- Backup restoration testing – Test restoring from backups to ensure reliability
- Incident response plan review – Review and update response plans based on lessons learned
- Threat hunting – Proactively search for threats such as suspicious encryption activities
Testing and exercises enable organizations to improve ransomware readiness, identify gaps in response plans, and strengthen capabilities to quickly contain and recover from real-world attacks before they become catastrophic.
What government resources help manage ransomware threats?
Government agencies provide various resources to help organizations combat ransomware:
- CISA Ransomware Guide – Best practices for prevention and response
- NIST Framework – Standards for cybersecurity programs
- FBI IC3 – Reporting ransomware attacks to the FBI
- MS-ISAC – Threat intelligence, notifications and resources for state and local agencies
- Cybersecurity agencies – Guidance from DHS, NSA, USSS, and DoJ
In addition, CISA maintains a ransomware resource library with useful tools, reports, webinars, and guidance.
How can software vulnerabilities be prevented from enabling ransomware?
Several best practices help prevent software vulnerabilities that can enable ransomware exploits:
- Regular patching and updates – Install software patches and updates as soon as available
- Vulnerability scanning – Scan regularly to identify insecure configurations or missing patches
- Vulnerability remediation – Prioritize and fix critical vulnerabilities based on severity and exploitability
- Reduce attack surface – Disable or decommission unnecessary ports, protocols, and services
- User access controls – Limit user privileges and application access to only what is required
- Input validation – Validate and sanitize all software inputs and queries
- Secure development – Build security into software design and development lifecycles
Keeping software updated and properly configured is one of the most effective ways to close doors to ransomware and cyberattacks.
How can organizations plan for and manage ransomware negotiations?
If organizations plan to engage in ransom negotiations, they should:
- Designate skilled negotiators – Choose negotiators carefully skilled in dialogue
- Consult law enforcement – Seek guidance from the FBI and cybersecurity agencies
- Establish communication – Initiate secure communications on your terms
- Demand proof of decryption – Require demonstration of decryption capabilities
- Negotiate payment tiers – Seek partial decryption for partial payment
- Clarify details – Get clear decryption instructions, timing, communication channels
- Control public messaging – Manage communications and minimize reputation damage
Experienced ransomware negotiators help ensure the highest possibility of data recovery at the lowest feasible cost.
What tools are available for decrypting ransomware?
The following resources may help decrypt some forms of ransomware:
- NoMoreRansom.org – Library of free ransomware decryptors
- Ransomware decryption tools – From security firms like Bitdefender and Emsisoft
- Ransomware Recovery Tools – Tool for recovering .crypt files
- Cryptogram – Tool for reverse-engineering some ransomware variants
- MichaelGillespie.org – Free ransomware analysis tools
With newer ransomware strains, decryptors are not always available immediately. But security researchers continually work to build decryption capabilities for new families.
What are the best practices for recovering from a ransomware attack?
The following are best practices to recover and restore systems after a ransomware attack:
- Isolate and contain – Disconnect infected systems from networks
- Determine variant – Identify the ransomware strain if possible
- Assess damage and impact – Determine which systems and data are impacted
- Evaluate backups – Identify usable backups to restore from
- Rebuild systems – Fully wipe and rebuild infected systems
- Reset accounts – Change all account credentials and passwords
- Close infection vector – Determine and mitigate root cause of infection
- Restore data – Restore from clean backups once systems are rebuilt
- Monitor systems – Closely monitor systems for any suspicious activities
Effective recovery relies on well-practiced incident response processes and backup restoration. Organizations should undergo proper forensic analysis during recovery efforts.
What training is recommended for employees to protect against ransomware?
Employees should regularly complete training on the following topics to protect against ransomware threats:
- Phishing awareness – Identify and report potential phishing emails
- Social engineering – Avoid phone, email and web-based social engineering schemes
- Cybersecurity policies – Understand and follow organizational policies
- Password management – Use strong, unique passwords and a password manager
- Web browsing risks – Exercise caution browsing websites and using public WiFi
- Removable media risks – Never open unknown USB or disks
- Reporting risks – Know how to report suspicious activity or alerts
Robust end user education combined with effective technical controls provides layered protection against ransomware and other cyber threats.
Conclusion
Protection against ransomware requires a proactive and layered cybersecurity program encompassing people, processes and technology. Key elements include user education, security software, access controls, vulnerability management, backups, and well-tested incident response plans. Organizations should seek assistance from cybersecurity professionals and government agencies for managing ransomware threats. While ransomware presents serious risks, the impact of attacks can be minimized through adequate preparation, prevention, detection, and response.