Have You Heard of Ransomware

Dominic Chromey • September 7, 2019

Approximately 60 percent of small business shut down within six months of a cyber attack.

It is estimated that a new organization falls victim to ransomware every 14 seconds in 2019. Do you know what to do if you or your business was infected with ransomware? While there is no fool proof protection for Ransomware there are ways to help mitigate risk and ensure your data is protected for a speedy recovery if you ever become infected.

What is Ransomware

Wikipedia defines ransomware as: "A type of malware from crypto-virology that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid." What does that mean? Similar to a kidnapping, your device or files may be inaccessible until a ransom is paid to a perpetrator.

There are currently two primary types of ransomware that are well known Encrypting Ransomware and Non-encrypting ransomware. To date the most famous encrypting ransomware was WannaCry. The WannaCry attack infected 250,000+ devices in over 116 countries in as little as 4 days. The most common form of non-encrypting ransomware is the FBI or DOJ Locker Ransomware. This ransomware locked the user out of a device and demanded ransom to unlock the device.

How do you get it

Ransomware is commonly spread through Email, Exposed RDP, Downloads from compromised websites. A Phishing Email, an email sent by someone posing as a legitimate person or company attempting to lure individuals into providing sensitive information, clicking a malicious link or opening an infected file. Common types are "Too Good to be True" a Nigerian prince wants to send you some money for example. An Email that has a sense of urgency, for example attached is your overdue invoice. Clicking the link or downloading the attachment puts you at risk for ransomware infection.

How can you protect yourself and Business from Ransomware

Prevention is key to protecting yourself against ransomware, below are some steps you can take to reduce the risk of a ransomware infection.

Annual Cyber-security Awareness training

Taking and requiring your users to take awareness training can help increase your security and increase your users awareness of the threat landscape that exists.

Patch Management

Ensuring proper patch management and ensuring you are on the latest update for your devices and workstations.

Enabling Controlled folder access

March 2018 Microsoft implemented controlled folder access in windows defender. This will allow the blocking of untrusted processes from writing to disk sectors.

Anti-virus and Anti-malware

Anti-Virus and Anti-Malware applications can detect malicious programs or code like ransomware in real-time before they are able to run, also white-listing software, will help prevent unauthorized applications from running or being executed.

Data backups are key in restoring from a ransomware attack

Data backups are as easy as 3, 2, 1, 1. Ensure you have 3 copies, using 2 different devices or media, and one of them is stored offsite.

Prevention is key but if you find yourself infected what to do

If you can avoid it do not pay the ransom. The FBI's recommendation is not to pay the ransom one of the primary reasons is there is no guarantee that you will be able to recover your data even if you do pay the ransom. Use sites like nomoreransom to see if there is a decryption solution available or other ways to restore access to your device or data.

Reboot into safe-mode if possible
Install and run anti-malware software
Restore the system to a known good configuration with system restore
Perform a full system wipe.
As a very last resort if you have no other options pay the ransom.
The final step but most important identify the cause of the infection and implement controls to help prevent reinfection.

< Older Post

Share

Mail

Ever heard of Shortcuts?!?!

By Dominic Chromey • April 18, 2019

So… You got a fancy new iPad or iPhone? Are you familiar with IFTTT? Then you need to check out the shortcuts app! I have created a “Morning Brief” that will grab the latest news from the morning and night before and reads me the content. It will also inform me of the weather and let me know what the percentage of rain or snow will be (in the Midwest we get a decent amount of snow). I am finding that the shortcuts app adds a huge amount of functionality for me and I don’t have to have as much face to screen time. I also recorded a message and so Siri call the shortcut for me automatically! In the short time I’ve been using Shortcuts I feel that I can save a great amount of time and become more efficient and if I can save time with shortcuts that’s more time I have to spend with my family and that is important to me!

Need email?

By Dominic Chromey • April 4, 2019

You are setting up or expanding your business and you realize you need to have email. What are you to do? There are multiple"free" ways to set up your email. The issue is that even if it claims to be free its not truly free. What do I mean, hosting providers, like gmail read your email and insert ads into your client and in some cases email. Also using a provider like gmail, not google apps, will not allow you to control over password resets or email setup; and will be @gmail.com not @yourdomain.com What if I don't have the budget? I can't afford $5 + per mailbox per month. I have a solution, host it yourself, in your cloud service of choice. At the time of this posting with D igital Ocean You can host your own container server with the recommended settings for $10/mo. Amazon AWS is $12 /mo if you pay for 12 months up front. With Microsoft Azure you could get it as low as $11 /mo if you pay upfront for 12 months. All in that's only 2 or less mailboxes with the other guys You can use https://letsencrypt.org/ for your SSL certificate. If you run a docker instance you can deploy a mail server with this set of pre-built containers by following the instructions and be up in running in 60 minutes or less with minimal upkeep and maintenance.

CIS Security Control Implementation

By Dominic Chromey • March 14, 2019

To better familiarize yourself with the CIS information security Controls please refer to cisecurity.org website. They break the 20 controls into 3 groups. Basic Controls, Foundation Controls and Organizational Controls. Follow us over the next few weeks as we implement the controls into our environment. We will share the tools chosen for each control and why, and also the basic process and special commands, if any, we used to successfully implement these controls.

My First Blog Post