The Myths of Ransomware Attacks and How To Mitigate Risk

Today’s modern companies are built on data, which now resides
across countless cloud apps. Therefore preventing data loss^[1]
is essential to your success. This is especially critical for
mitigating against rising ransomware attacks — a threat that
57% of security leaders expect to be
compromised by within the next year^[2].

As organizations continue to evolve, in turn so
does ransomware^[3]. To help you stay ahead,
Lookout Chief Strategy Officer, Aaron Cockerill met with Microsoft
Chief Security Advisor, Sarah Armstrong-Smith to discuss how
remote work^[4]
and the cloud have made it more difficult to spot a ransomware
attack, as well as how deploying behavioral-anomaly-based detection
can help mitigate ransomware risk. Access the full interview^[5].

Aaron Cockerill: I feel like the way modern
enterprises operate, which includes a combination of technologies,
has allowed the ransomware to thrive. Having experienced this type
of attack in my past roles, I know how many CISOs are feeling out
there. The human instinct is to pay the ransom. What trends are you
seeing?

Sarah Armstrong-Smith: It’s quite interesting
to think about how ransomware has evolved. We think about these
attacks as being really sophisticated. The reality is that
attackers favor the tried and tested: they favor credential theft,
password spray, they’re scanning the network, buying credentials
off the dark web, using ransomware kits.

So in many ways, things haven’t changed. They are looking for
any way into your network. So although we talk about cyber attacks
becoming sophisticated, that initial point of entry really isn’t
what sets the ransomware operators apart, it’s what happens
next.

It’s down to that persistence and patience. The growing trend is
that attackers understand IT infrastructure really well. For
example, lots of companies are running Windows or Linux machines or
have entities on-premises. They might also be utilizing cloud
services or cloud platforms or different endpoints. Attackers
understand all that. So they can develop malware that follows those
IT infrastructure patterns. And in essence, that’s where they’re
evolving, they’re getting wise to our defenses.

Aaron: One evolution we’ve witnessed is the
theft of data and then threatening to make it public. Are you
seeing the same thing?

Sarah: Yeah, absolutely. We call that double
extortion. So part of the initial extortion could be about the
encryption of your network and trying to get a decryption key back.
The second part of the extortion is really about you having to pay
another amount of money to try and get your data back or for it not
to be released. You should assume that your data is gone. It’s very
likely that it’s already been sold and is already on the dark
web.

Aaron: What do you think are some of the common
myths associated with ransomware?

Sarah: There’s a misconception that if you pay
the ransom, you’re going to get your services back quicker. The
reality is quite different.

We have to assume that ransomware operators see this as an
enterprise. And, of course, the expectation is that if you pay the
ransom, you’re going to receive a decryption key. The reality is
that only 65% of organizations actually get their data back. And
it’s not a magic wand.

Even if you were to receive a decryption key, they’re quite
buggy. And it’s certainly not going to open everything up. Often,
you still have to go through file by file and it’s incredibly
laborious. A lot of those files are potentially going to get
corrupted. It’s also more likely that those large, critical files
that you rely on are the ones you won’t be able to decrypt.

Aaron: Why is ransomware still affecting
companies so badly? It seems like we’ve been talking about methods
attackers use to deliver these attacks, such as phishing and
business email compromise, as well as preventing data exfiltration
and patching servers forever? Why is ransomware still such a big
problem? And what can we do to prevent it?

Sarah: Ransomware is run as an enterprise. The
more people pay, the more threat actors are going to do ransoms. I
think that’s the challenge. As long as someone somewhere is going
to pay, there is a return on investment for the attacker.

Now the difference is, how much time and patience does the
attacker have. Particularly some of the larger ones, they will have
persistence, and they have the willingness and desire to carry on
moving through the network. They’re more likely to use scripting,
different malware, and they’re looking for that elevation of
privilege so they can exfiltrate data. They’re going to stay in
your network longer.

But the common flaw, if you like, is that the attacker is
counting on no one watching. We know that sometimes attackers stay
in the network for months. So at the point where the network’s been
encrypted, or data exfiltrated, it’s too late for you. The actual
incident started weeks, months or however long ago.

That’s because they’re learning our defenses: “will anyone
notice if I elevate privilege, if I start to exfiltrate some data?
And assuming I do get noticed, can anyone even respond in time?”
These attackers have done their homework, and at the point where
they are asking for some kind of extortion or demand, they’ve done
a huge amount of activity. For bigger ransomware operators, there
is a return on investment. So they’re willing to put the time and
effort in because they think they’re going to get that back.

Aaron: There’s an interesting article written by Gartner^[6] on how to detect and
prevent ransomware. It says the best point to detect attacks is in
the lateral movement stage, where an attacker is looking for
exploits to pivot from or more valuable assets to steal.

I think that that’s one of the most fundamental challenges that
we have. We know what to do to mitigate the risk^[7]
of phishing — although that’s always going to be an issue because
there’s a human element to it. But once they get that initial
access, get an RDP (Remote Desktop Protocol), or credentials for
the server or whatever it is, and then they can start that lateral
movement. What do we do to detect that? Sounds like that’s the
biggest opportunity for detection.

Listen to the full interview^[8]
to hear Sarah’s thoughts on the best way to detect a ransomware
attack.

The first step to securing data is knowing what’s going on. It’s
hard to see the risks you’re up against when your users are
everywhere and using networks and devices you don’t control to
access sensitive data in the cloud.

Eliminates the guesswork^[9] by gaining visibility
into what’s happening, on both unmanaged and managed endpoints, in
the cloud and everywhere in between. Contact Lookout today^[10].