Ransomware Survival Guide

Share This Post
Share on facebook
Share on linkedin
Share on twitter
Share on email

According to the New York Times, a widespread ransomware attack that rooted in Europe has made its way to the States. The strain Kapersky coined “NotPetya” reportedly bulldozed its way into some of the nation’s most prominent healthcare organizations. In the U.S., it affected pharmaceutical giant Merck. NotPetya exhibits traits similar to the original Petya (hence the name) as well as the infamous WannaCry ransomware that recently infected more than 200,000 computers across the globe. The aforementioned attack took hold of almost 2,000 systems.

The promise of a fast and easy payday has helped ransomware become a worldwide epidemic. There appears to be no end in sight. But adopting a survivalist mentality can dramatically reduce your exposure to this rapidly growing cyber security threat.

What Makes Ransomware Tick?

Ransomware is a very intriguing animal. It’s a seemingly unstoppable threat that uses encryption, one of the most reliable security technologies, as its primary weapon. In its simplest form, the malware installs itself on the targeted system via common distribution channels. It encrypts core system files, then holds the data hostage until a ransom is paid. But it doesn’t stop there. Ransomware is rapidly evolving in both numbers and capabilities.

Now keep in mind that the data varies depending on the source cited, but Carbon Black reports that ransomware grew by 50 percent from 2015 to 2016, making it the fastest growing form of malware by far. The average ransom fee has also climbed to nearly $1100, up from the near $300 calculated for the previous year. A thriving black market exists today that basically provides DIY ransomware kits for pennies on the dollar. This explains the non-stop roll out of new threats. End users often lack awareness, which is why ransomware has become alarmingly more effective.

Beyond the sophisticated weaponry is a harsh truth that makes ransomware and cyber crime in general virtually impossible to thwart. The ungovernable Bitcoin economy has given hackers an ideal way to manage transactions. They can collect payments, transfer funds, and move on to the next target with little to no trace. They will use VPNs and botnets that remotely control thousands of zombie computers – to remain anonymous. It’s a business model is carved out of pure brilliance.

Businessman hand using modern laptop with Cloud Backup concept

Backup is the Key

A band of cyber thieves hijacks your files and demands you pay a handsome ransom to get them back. Sounds like a disastrous situation to me. Luckily you have your backup plan, because it’s your best weapon in the fight against ransomware. If push comes to shove, you can restore your data from backups and avoid paying the ransom. Here’s a few tips for ransomware protection and recovery.

Create a regular backup schedule: In order to truly minimize the sting of a ransomware attack, you must back up your mission-critical data on a regular basis. If you store data in the cloud, make sure you have another copy somewhere offline. If you have backups stored on disks in your data center, keep extra copies somewhere offsite. Your data is always changing, so a regular backup schedule will allow you to restore the most up to data version.

Test your backups: The last thing you want to do is fire up your backups in an emergency situation only to find that they fail. Get into the habit of periodically testing your backup copies to make sure you can reliably restore data. This applies to NAS devices, cloud servers, thumb drives, and any other storage medium that holds precious data.

Get granular with recovery: Some ransomware strains lock up your entire OS, but others only encrypt select files. Since you never know what will be targeted in an attack, having granular recovery options will come in handy. Whether it’s at the file level or object level, organizations need a comprehensive solution. Restoring data saved a couple hours ago should be as easy as recovering last night’s full backup.

Background conceptual image with social connection lines on dark backdrop

Taking Administrative Action

Neutralizing ransomware starts at the top. Guided by their trusty team of business continuity managers and system administrators, organizations can lay down sturdy roadblocks that stop the threat dead in its tracks.

Educate and train employees: While ransomware is certainly a unique type of attack, it gets around just like most other malicious software. If prevention is the best form of protection, then you might say relying on such a primitive distribution method is its biggest flaw. You need to train employees on how to avoid malware and also understand the repercussions of a successful ransomware exploit.

Restrict administrative control: Ransomware villains like the original Petya require root privileges in order to compromise the targeted system. By acting as the administrator, this particular variant is able to overwrite the master boot record and swap it out for malicious code … then it’s all downhill from there. The good thing is this type of ransomware can be neutered by simply restricting administrative access in your configuration settings.

Commit to patch management: The NotPetya strain wrecking havoc across the globe was able to make its mark by exploiting a bug in Windows. Make sure you regularly update your systems and apply any new patches. This simple strategy gives ransomware one less door to sneak in.

Simple Security Practices That Work

By the time ransomware is installed on your system, it’s already too late. You either hit the reset button with a fresh restore, or pay the piper. Luckily there are a few security features and strategies you can employ to keep the money hungry hackers at bay.

Use email filtering: This reduces the number of potentially malicious emails coming your way. The spam filters of the Gmail, hotmail and Yahoo are hit or miss. Businesses will have better luck with enterprise-grade solutions. These will use advanced techniques such as sandboxing, writing style analysis, and computer vision while leveraging AI to balance the filtering of spam and legitimate mail.

Scan attachments: If email is the vehicle that drives it, then the attachment is the cargo you open to unknowingly unload the malware on your system. A lot of enterprise spam filters have scanning functions that allow you to check your messages for potential threats. Whether it’s built into your spam filter or anti-malware software, put those scanning capabilities to use before opening any email attachments.

Block attachments: Blocking select attachments is one of the most effective ways to stop ransomware at the gate. The system may prevent users from opening .exe, .com, .bat, .js, .docx, and other file types commonly associated with malware. Because this method could also restrict access to legit files you actually need, it might be a good idea to designate a separate server, such as the cloud, for exclusively handling blocked file types.

Raise awareness: Like malware in general, ransomware distribution is not limited to email. This type of infection can be spread by visiting rogue websites, downloading free software, and even connecting infected USB drives to your system. A computer security training program that covers all the basics of responsible web browsing can make a world of difference when it comes to staying protected.

white keyboard with green data protection button

Advanced Ransomware Protection

The alarming effectiveness of ransomware is directly tied to conventional security tools and their inability to keep up. With a few alterations, a common variant your antivirus software would’ve been able to detect a week ago could become an all new threat with zero-day impact. This simple trick enables malware authors to keep production rolling as they crank out ransomware that is practically undetectable to signature-based security solutions.

Advances in ransomware have led to a need for more advanced protection. One approach that shows tremendous promise is built around sandboxing technology. A sandbox creates a virtual environment that isolates and prevents malware from tampering with data on your system. While ransomware can still encrypt files within the isolated container, all files outside of the sandbox remain protected. There are also behavioral-based security solutions that trick ransomware into believing it is forever trapped.

Responding to Ransomware

How you respond to a ransomware infection goes a long way in minimizing the damage. In the event that an attack happens to slip through the cracks, the following steps will help you mitigate the issue in timely fashion.

Isolate the threat: The typical ransomware strain wants to propagate and spread itself to as many hosts as possible. You can minimize its reach by immediately disconnecting the infected machine from all other devices on the network. This goes for wired and wireless connections as well as any backups connected to external storage media.

Analyze the threat: You can lean a lot from the error messages, instructions, and output that follows a successful ransomware attack. If possible, get a screenshot of what’s in front of you so security personnel can go to work. Proper threat analysis can help you identify the attack vector, pinpoint the location of compromised files, and even come up with solutions for decrypting your data.

Identify the source: Ransomware infections originate from a number of attack vectors. Maybe it was a cleverly crafted phishing email or Trojan bundled with a program an employee downloaded. Identifying the source can help your security response team better understand the attack and more importantly, prevent exploits in the near future.

Mitigate the threat: This is where your disaster recovery prowess comes into play. If you’re restoring from clean backups, then you should be back up and running with little delay. However, you may encounter potential issues if you elect to pay the ransom. Sure, you got your files back, but that doesn’t necessarily mean you’re in the clear. If eradication is the plan, you need to be overly diligent in combing your system to be certain that the threat has been completely eliminated.

Report the attack: Ransomware victims should report all incidents to the proper authorities. For example, U.S. victims can submit details of an attack to the FBI’s Internet Crime Complaint Center. Filing a complaint probably won’t accomplish much in the way of tracking down criminals or recovering your data any faster. However, it could lead to more accurate reporting, which in turn, increases ransomware awareness and hopefully puts more organizations and end users on alert.

Join us

Disclaimer

GENERAL

The expertise and information that Clarity supplies via this website are supplied “as is”. Unless otherwise stated explicitly, Clarity does not make any representations or warranties, expressed or implied, regarding any of its services nor in general, including any implied warranties of merchantability or fitness for a particular purpose; nor any implied warranties arising from a course of dealing or course of performance. Clarity services rely exclusively and strictly upon agreements duly concluded with clients, partners, suppliers, and other third parties, as relevant. 

Since the security environment in cyberspace, and specifically cyber threats, are dynamic and constantly changing, Clarity wishes to clarify that all information included on this website, whether supplied by Clarity or other parties in the framework of its supplying of services and expertise, does not constitute any representation or promise on the part of Clarity or on its behalf, that:

  1. Any list of sources or origins of cyber threats and/or the construction and design of potential threat references and/or construction of processes and/or methodology regarding cyber threats constitutes a final list and/or a total and/or a fully appropriate solution, nor that- 
  2. Such information implies exemption from exposure to any cyber attack or event, or being a victim thereof. 

Finally, Clarity shall have no liability whatsoever regarding any third-party terms, activities, or omissions that may be included in the information on this website.

 

LIMITATION OF LIABILITY 

In no respect or event shall Clarity, nor anyone on Clarity’ behalf, be liable for any indirect, special, consequential or incidental damages whatsoever (including, as relevant and without limitation, costs of procurement of substitute services, damages for loss of business profits, business interruption, loss of business information or data, or other pecuniary or reputational loss) arising out use of information on this website, or any other use of this website. Clarity is also exempt from any criminal liability with respect to the information supplied on this website or the use of the website.

INTELLECTUAL PROPERTY

Clarity fully retains intellectual property rights with respect to materials it has developed, notwithstanding the publication of said materials on this website. 

 

Data Protection Policy and Cookies Policy

​ This Data Protection Policy (hereinafter, “Policy”) applies to all activities of Clarity Ltd. (hereinafter, “Clarity” or “we”) with respect to the protection of personal data that Clarity collects, processes and stores in the course of its business activities, including through its website (“website”) and applications (“apps”), as well as any other electronic interfaces with data subjects. Clarity is registered in Israel, with its head office located at 30 Shacham St., Petach Tiqwa, 4918001, Israel Company Registrar No. 514508993. For any questions regarding the collection, processing or use of personal data relating to you (as explained below) please contact us via at: [email protected]. The language of this Policy is intended to be gender-neutral. ​
  1. General principles
​​
  • ​We are committed to ensuring that your personal data and data privacy are protected in accordance with accepted practices, as well as according to our relevant legal obligations. This Policy explains your rights regarding the personal data we collect, process and use in our ongoing business operations, including via the website, as well as our use of safeguards to protect these rights. The Policy also applies to Clarity’s use of cookies and tracking on the website interfaces, as specified in the Cookies Policy below.
  • ​Your personal data is collected and stored lawfully, fairly and transparently by Clarity. In processing your data, we act in good faith, in a proportionate manner, and with the appropriate technical and organizational measures; and to mitigate the risks represented by the processing of the data.
  • ​Please be aware that the collection, processing and use of your personal data may be carried out by external data processors on our behalf in the course of Clarity’s ongoing business and our supply of services to you. Within the framework of our contracts with such external processors, we will require them to duly comply with relevant legal data protection rules and legislation applicable to the services they provide to us.
  • ​We may revise this Policy from time to time, and such changes shall come into effect from the moment we notify you of such changes and/or updates, either on the website or in some other reasonable manner.
  • ​For data subjects of the European Union, your rights under the General Data Protection Regulation (GDPR) are safeguarded by Clarity in accordance with the principles detailed below. Any questions regarding GDPR-related rights may be referred to us via the email address: [email protected]
  1. Data Subject Rights
Subject to the applicable law that determines your status as a data subject and the jurisdiction in which you are located, you may have some or all of the following rights in respect of your personal data that we process:
  • ​Consent For data subjects for which processing by explicit consent is relevant, we will only process personal data if you have consented to such processing, unless we are otherwise legally authorized or obliged to collect and further process personal data relating to you; and data will be processed solely based on your informed consent, used only for the purposes stated in the consent procedure (for example, in order to send Clarity newsletters and the like), and within the scope outlined below.
  • Withdrawal of consent– You may revoke or withdraw your consent at any time by notifying us directly via the email address [email protected] Upon receipt of your request, and subject to applicable laws, we will delete your data unless we are legally obliged or authorized to retain it and your consent to its processing, including for ongoing legitimate business interests of Clarity. Withdrawal of your consent shall not have any influence over the legality of processing of your personal data carried out prior to said withdrawal.
  • Minimization of data processing – We process and store a minimum of your personal data, only as needed for providing our services to you.
  • The “right to be forgotten”– You may also request the erasure of all or part of your personal data held by Clarity. Upon receiving your request via the email address, we will remove your personal data from all of our records, as soon as reasonably possible and when technically feasible, unless there is an overriding legal interest or other legal basis for the continuation of the data processing. Please understand that in the event of deletion of personal data upon your request, Clarity may not be able to further provide services via the website and other interfaces, in whole or in part. In requesting data deletion, you irrevocably agree and waive any claim against Clarity’s inability to provide said services, or any interruption or malfunction resulting therefrom. Note that your request for deletion may also be rejected by Clarity for lack of sufficient relevant information provided by you.
  • ​The “right to data correction”– You may also request the correction of all or part of your personal data held by Clarity. Upon receiving your request via the email address, we will correct your personal data, as soon as reasonably possible and when technically feasible, unless there is an overriding legal interest or other legal basis for the continuation of the data processing. In requesting data correction, you irrevocably agree and waive any claim against Clarity’s inability to provide said services, or any interruption or malfunction resulting therefrom. Note that your request for correction may also be rejected by Clarity for lack of sufficient and/or relevant information provided by you.
  • ​Transparency and portability of personal data– You are entitled to ask Clarity for information about the type of personal data about you that we process. You are also entitled to obtain it in a commonly-used and machine-readable form, subject to technical feasibility and lawfulness considerations. Please forward your request via the email address [email protected]
  • Automated decision-making on the basis of your personal data– Although the situation will be rare, we may make decisions concerning our business relationship with you based on automated processing operations without human intervention. We commit to giving you the opportunity to obtain human intervention in such a decision, express your point of view, and obtain an explanation of the decision. Please send your request regarding automated decision-making via the email address [email protected]
  • Personal data relating to children and minors– We do not knowingly collect or process personal data relating to children and minors under the age of 16 years, unless we are legally obliged to do so. If we become aware that personal data was transferred to us or collected by us relating to children and minors under the age of 16 years without the informed consent of a parent or legal guardian, we will delete such personal data without undue delay. Please forward any requests in this respect via the email address [email protected]
  • ​In the implementation of these data protection rights, Clarity is committed to providing a timely and transparent response to your requests. For any questions regarding these rights, please contact us via the email address [email protected]
  1. Why Clarity uses your personal data
  • ​Clarity uses your personal data to provide the services requested by you and to process your requests and inquiries.
  • ​Your personal data is also used for the cookies and tracking utilized in the websites and apps to distinguish you from other users, to improve your use of these interfaces, and to ensure that content in the website and other relevant interfaces is presented in the most effective manner for you.
  • ​Additional information about our use of cookies and tracking may be found in our Cookies Policy below.
  1. The types of personal data we collect and how we use it
  • ​The personal data collected and used by Clarity is limited strictly to the data necessary for us to provide you with services we supply in the course of our ongoing business services, while operating under the relevant data protection and other regulatory obligations. Access to your data, including physical access, is limited to only those employees of Clarity and third parties who have contracted with us and who utilize it exclusively for the purposes outlined below.
  • ​There may be rare circumstances in which we ask you for sensitive personal information, in order to provide you with services in our current area of ​​business. In such a case, we will only use this information for these purposes and will delete it when the purpose for which the information was collected or processed is terminated, unless there is a legal obligation not to delete this information
  • ​The data collected and processed is both general in nature, (for example, for technical purposes) and, depending on the services you select and utilize, personal data such as your name, contact details, some identifying numbers, the name of your internet provider, your IP address, browser type and system software, as well as the websites you have visited before being transferred to the Clarity website, including keywords used for searches and the sites from which you have been transferred (e.g., search engine or linked content).
  • ​There may be circumstances in which automatic processing of your personal data may occur. As is true of most organizations operating websites, we gather certain information automatically and store it in log files. This information includes but is not limited to IP addresses, type of browser, Internet service provider, referring and exit pages, operating systems, a date/time stamp and clickstream data. We may use this information to analyze trends, to administer the website and apps, to track users’ movements through them and to gather information about our user base as a whole. We may link this automatically-collected data to personal data for legitimate business purposes, such as to detect and prevent fraudulent activity; and other legally-authorized purposes.
  • ​When you receive services from Clarity through the website and other electronic interfaces, you may also be directed to third-party processors. When we use such third-party processors, we rely on the third-party service provider to process personal data in order to provide certain services; and we contractually require them to comply with the data protection and other laws and regulations applicable to their processing services. Please check the respective service provider’s relevant data protection terms and compliance with applicable laws prior to usage of any such processor’s services. The same applies to any links to and from websites of third-party networks, advertisers and affiliates. Such third-party websites are governed solely by such third parties’ data protection policies: you are advised to be careful and check any such third party’s privacy policies and compliance with laws, prior to supplying them with any of your personal data to them.
  • ​Please note that Clarity may also disclose your data to a third party if we are required to do so by applicable law, court order or governmental regulation; or if such disclosure is otherwise authorized and necessary in support of any criminal or legal investigation or proceeding in accordance with applicable laws and regulations.
  • ​Clarity may need to transfer the data submitted by you for the purposes described above to third parties in locations outside the country in which you are physically located, potentially including countries which may not require an adequate level of protection for your personal data compared with that provided in your country. By accepting this Policy, you consent to such data transfer as described in this section.
  1. Clarity’s protection of your personal data
  • We have taken all reasonable, industry-standard technical and organizational measures to protect your personal data against loss, alteration, theft or access by unauthorized third parties.
  • We will not sell, share, transfer or use the data we collect from you for purposes other than those purposes stated expressly in this Policy.
  • We will delete your personal data where the business purpose for which the data was being collected or processed ceases to apply, or if applicable data protection rules require us to delete such personal data.
  • The above notwithstanding, Clarity will not be liable or responsible in any way, including financially, for any damage or loss resulting from the improper use or any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, your personal data. For more detailed information on the limitation of Clarity’ liability, please refer to the Disclaimer on the Clarity website.
  1. Cookies Policy 
  • This Cookies Policy applies to all activities of Clarity with respect to the cookies that we collect and store in the course of our business activities, including through the website and other electronic interfaces with data subjects that we operate.
  • Important note –Use of the Clarity websites by you indicates your acceptance of this Cookies Policy.
  • What’s a cookie?A cookie is a small file sent from a website, which is then stored by your web browser. The information in the cookie can be used to recognize your last session with Clarity. Cookies cannot install malicious software such as viruses on your device, and they do not store any of your personal data or account information.
  • Why do we use cookies?We use cookies to save and maintain Clarity users’ settings and selected preferences during browsing sessions, for saving repeating users’ preferences for future use (e.g. geographical location, accessibility and language selections and preferences), and for statistical analysis of the performance of websites and apps, trend analysis, and monitoring and identifying errors.
  • Where do cookies come from?Cookies originate from two types of sources: 1st -party and 3rd -party. This classification refers to the internet domain that is placing the cookie.
    • 3rd- party cookies are cookies that are set by a domain other than that of the site being visited by the user. If a user visits a website and another entity sets a cookie through that site this would be a 3rd -party cookie.
    • 1st-party cookies are those set by a website that is being visited by the user at the time.
  • Opting in– When you first visit the websites and apps, you will be given the option to accept or decline the use of cookies. You can also control the use of cookies at the individual browser level, and instructions for managing cookie usage can be found for the following browsers, at:
    • Google Chrome 
    • Internet Explorer 
    • Firefox
    • Safari
    • Safari Mobile
    • Opera
  • If you do not opt into cookies, you may still use the websites and apps, but your ability to use some features may be limited or unavailable. Many browsers allow a private mode to be activated through which the cookies are always erased after the visit, and you hereby irrevocably and unconditionally waive any claim or demand in this regard. If you wish to opt out of interest-based advertising, click <http://preferences-mgr.truste.com/>. If you are located in the European Union click <http://www.youronlinechoices.eu/>.
  • Do Not Track/Privacy Modeis a function that allows users to opt out from being tracked by websites for any purpose including the use of analytics services, advertising networks and social platforms.
  • If you have enabled the “do not track” functionin your browser, you will not be tracked. This is in addition to you opting-out of the aggregation and analysis of data for the website and app statistics.
  • Categories of cookies we use– Clarity places a high priority on the security and confidentiality of the information stored in the persistent cookies we use. The categories we use are as follows:
    • ​Performance cookies – These cookies allow publishers to track your behavior as a site visitor, measure site performance, and improve your user experience.
    • ​Functionality cookies – There are different types of cookies in this category, and they are used to customize the site for your personal use using the options you specify, such as your language preference.
    • ​Targeting cookies – These cookies help you track relevant ads for you. They help record your use of these ads, including limits on how often you view them.
  • Any questions?For any questions about the use of cookies by Clarity, please be in touch with us via the email address [email protected]