Cybereason, the leader in operation-centric attack protection, today issued a Ransomware Advisory, through its government subsidiary, Cybereason Government Inc, warning government agencies and all organizations about a possible surge in ransomware attacks during the holidays and weekends. Cybereason Government Inc briefed more than 20 officials from CISA, the FBI and U.S. Secret Service on its Advisory and its recent global ransomware study.
The genesis of advisory is based on new research published this week. Cybereason published results from a global research study looking at organizations that have previously suffered a successful ransomware attack on a holiday or weekend. A key result highlights the disconnect between organizational risk and preparedness.
The report, titled Organizations at Risk: Ransomware Attackers Don’t Take Holidays, found that the vast majority of security professionals expressed high concern about imminent ransomware attacks, yet nearly half felt they do not have the right tools in place to manage it.
“Cybereason Government Inc’s Holiday Ransomware Advisory was created to increase awareness and offer prescriptive advice and recommendations on how to address the ransomware risk and reduce the likelihood of successful ransomware attacks during the 2021 holiday season,” said Sam Curry, President of Cybereason Government Inc and Chief Security Officer, Cybereason.
Also Read: Three Reasons Why Application Security Is a Game-Changer for Every Organization
The report outlines recommendations for how to reduce the risk of a ransomware attack during the holiday season and weekends, including:
- Practicing good security hygiene like implementing a security awareness program for employees, assuring operating systems and other software are regularly updated and patched, and deploying best-in-class security solutions on the network.
- Assuring key players can be reached at any time of day as critical response actions can be delayed during weekend/holiday periods. Having clear on-call duty assignments for off-hours security incidents is crucial here.
- Conducting periodic table-top exercises and drills and including those beyond the security team like Legal, Human Resources, IT Support and all the way up to the Executive Suite is also key to running a smooth incident response.
- Ensuring clear isolation practices are in place to stop any further ingress on the network or spreading of the ransomware to other devices. Teams should be proficient at things like disconnecting a host, locking down a compromised account, and blocking a malicious domain, etc. Testing these procedures with scheduled or unscheduled drills at least every quarter is recommended to make sure all personnel and procedures work as expected.
- Evaluating lock-down of critical accounts for the weekend/holiday when possible. The usual path attackers take in propagating ransomware across a network is to escalate privileges to the admin domain-level and then deploy the ransomware. Those highest privilege accounts in many cases are rarely required to be in use during the weekend or holiday breaks. Teams should create highly secured, emergency-only accounts in the active directory that are only used when other operational accounts are temporarily disabled as a precaution or inaccessible during a ransomware attack.
- Deploying EDR on all endpoints. The quickest remedy to the ransomware scourge for public and private sector businesses is deploying EDR on endpoints according to Gartner’s Peter Firstbrook. Yet Firstbrook says that only 40 percent of endpoints have EDR.
For more such updates follow us on Google News ITsecuritywire News
