How to Defend Against Ransomware and IoT Attacks

TL;DR

Reduce ransomware damage by restricting network-share permissions, maintaining strong security hygiene, protecting backups, and deciding in advance who can authorize a payment. Treat connected devices as a complex attack surface and a potential attack platform because compromised IoT systems can collectively generate disruptive denial-of-service traffic.

Transcript

Good morning. Thank you for being here. Thank you for joining us for the tenth annual Most Dangerous New Attacks panel at RSA. I'm just so pleased we're in a room where there aren't five hundred people standing outside yelling, "We wanna get in, too." So thank you for being here, and thank you to RSA for allowing us to, to, to continue this traditi... Read More

Key Insights

• Crypto ransomware is an efficient attack method because it can encrypt data without requiring the attacker to exfiltrate that data or maintain command-and-control communications. The affected information remains inside the victim's environment, while the victim must contact the attacker to request a decryption key.
• Public key cryptography is used by crypto ransomware to deny victims access to important information. The same general technology that supports secure commerce and communication can therefore be applied maliciously to create operational disruption and pressure victims into paying for recovery.
• Ransomware is increasingly directed at organizations rather than only individual consumers. Attackers seek accessible backups and network shares because encrypting shared storage can disrupt an entire file server or a broader group of servers, greatly increasing the operational impact of one infected endpoint.
• Security hygiene is a foundational ransomware defense. The Center for Internet Security critical controls describe activities intended to make an environment more secure than the average organization, which can materially improve its ability to prevent or contain this type of attack.
• Least-privilege access is a practical way to contain ransomware. When users can reach only the files required for their jobs, malware running under one compromised account may encrypt some accessible data but should have less ability to disable an entire shared server.
• Ransomware response is a business decision as well as a technical problem. Organizations should determine in advance who has authority to decide whether a ransom will be paid because stated principles may conflict with the financial and operational consequences of prolonged data loss.
• Ransomware payment can become a negotiation with attackers. The panel advises victims who enter such a negotiation to appear small and financially constrained because attackers may accept some payment rather than receive nothing, although this advice applies only after disaster has already occurred.
• The Internet of Things is both an attack surface and an attack platform. Its devices interact through multiple wireless protocols, mobile devices, and cloud services, while compromised systems can be assembled into a distributed platform for generating denial-of-service traffic against external targets.

Questions & Answers

Q: How does crypto ransomware hold business data hostage?

Crypto ransomware enters a system and uses cryptography to encrypt information that the victim needs. The attacker does not have to remove the data from the organization or continuously communicate with the malware. The files remain in the victim's environment, but they become unusable, forcing the victim to contact the attacker and request the key needed for decryption.

Q: Why is crypto ransomware efficient for attackers?

Crypto ransomware reduces several operational burdens for an attacker. It can cause damage without a continuing command-and-control channel, and it does not require data exfiltration because the valuable information stays inside the victim's systems. The victim also initiates contact to recover the data, creating a direct path for the attacker to demand payment and conduct a negotiation.

Q: How can organizations limit ransomware on network shares?

Organizations can limit the spread of ransomware by removing unnecessary shares between individual workstations and allowing file-server shares only when a defined business need exists. Permissions should be restricted so each user can access only the information required for the job. If one workstation becomes infected, those limits can reduce the amount of server data the malware is able to encrypt.

Q: Why should backups be protected from ransomware?

Backups are important targets because they may provide the organization with a way to restore encrypted information without obtaining a key from the attacker. The transcript warns that ransomware is increasingly designed to find and encrypt accessible backups along with network shares. Organizations should therefore consider backup exposure when preparing for this attack, rather than assuming that the mere existence of backups guarantees recovery.

Q: Who should decide whether an organization pays ransomware?

The organization should identify the authorized decision-maker before an incident occurs. A general policy against paying attackers may become difficult to maintain when the alternative is extended downtime or the loss of valuable data. Establishing responsibility in advance prevents the decision from being improvised during a crisis and ensures that the relevant business consequences are considered alongside the technical situation.

Q: How should a victim approach ransomware negotiation?

If an organization enters a ransomware negotiation, the panel advises presenting the victim as small and unable to afford a large payment. Attackers are described as practical operators who may prefer receiving some money to receiving none. The guidance is to avoid emphasizing the organization's size or the importance of the encrypted system, since that information could strengthen the attacker's demand.

Q: Why is Internet of Things security so complex?

Internet of Things security spans an infrastructure rather than a single category of device. Embedded systems may communicate through several wireless protocols, interact with phones and tablets, and depend on cloud-based control. These technologies converge within one environment, so defenders must consider the relationships among devices, communications, mobile interfaces, and remote services instead of evaluating each connected product in isolation.

Q: How can compromised IoT devices become an attack platform?

Attackers can infect large collections of connected devices and coordinate them to generate denial-of-service traffic against another target. In that role, IoT equipment is no longer merely the object being attacked. It becomes infrastructure used to launch attacks. The Mirai worm is presented as an example that demonstrated how compromised systems could collectively produce enough traffic to take targets offline.

Summary & Key Takeaways

• Crypto ransomware gives attackers a practical way to hold critical data hostage without stealing it or continuously controlling infected systems. The malware can encrypt local files, network shares, and accessible backups. Because the victim must seek decryption assistance, organizations should prepare both technical defenses and a defined business response before an incident occurs.

• The recommended ransomware defenses begin with established system and network security hygiene. Organizations should remove unnecessary workstation shares, permit server shares only for defined business needs, and grant each user only the access required for the job. These measures can limit how far encryption spreads when a workstation becomes infected.

• Internet of Things security involves more than protecting isolated devices such as thermostats, light bulbs, or DVRs. Connected environments combine embedded devices, wireless protocols, mobile systems, and cloud services. Compromised devices can also become an attack platform, allowing attackers to coordinate large-scale denial-of-service traffic against other systems and organizations.