{"id":71,"date":"2022-11-30T12:00:04","date_gmt":"2022-11-30T12:00:04","guid":{"rendered":"http:\/\/closehelmsecurity.co.uk\/?p=71"},"modified":"2024-03-17T16:27:43","modified_gmt":"2024-03-17T16:27:43","slug":"think-technology-process-human-risk-to-manage-ransomware","status":"publish","type":"post","link":"http:\/\/closehelmsecurity.co.uk\/?p=71","title":{"rendered":"Security Think Tank: Think technology, process, human risk to manage ransomware"},"content":{"rendered":"\n

Originally published on ComputerWeekly.com<\/a><\/p>\n\n\n\n

Effective ransomware handling is not simple \u2013 it must span every area of the business and requires a multi-layered approach. To achieve this, CISOs need to focus on providing all employees and the organisation with the necessary \u201ctools\u201d to recognise and react appropriately to an attack and prevent it from succeeding.<\/p>\n\n\n\n

Effective ransomware handling is not simple \u2013 it must span every area of the business and requires a multi-layered approach. To achieve this, CISOs need to focus on providing all employees and the organisation with the necessary \u201ctools\u201d to recognise and react appropriately to an attack and prevent it from succeeding.<\/p>\n\n\n\n

These can be broken down into three core areas \u2013 technology, process and human risk.<\/p>\n\n\n\n

Technology<\/h3>\n\n\n\n

Technology provides various ways to guard against ransomware attacks. The threat evolves constantly, so it is important to be proactive to ensure that detection and defence systems (such as firewalls) at the endpoints of systems are always up to date and as strong as they can be.<\/p>\n\n\n\n

Patching all the public-facing systems and platforms that extend the organisation\u2019s network perimeter is essential to avoid data extortion and leaks, as is keeping all software updated and patched. Computers need to run the latest operating systems, applications and anti-virus, and only protected devices should be allowed to connect to the company\u2019s resources. Whitelisting applications to determine which can be downloaded and executed on a network is also good practice.<\/p>\n\n\n\n

CISOs should ensure their organisation has a comprehensive asset inventory, so they can understand the operational value of each asset \u2013 and therefore the risk \u2013 should it be compromised. This helps to assign priority protection to the highest value assets and, in the event of an attack, may help the organisation to determine what should be protected or (in a worst-case scenario) recovered first.<\/p>\n\n\n\n

Identity and access management has a key role in guarding against ransomware because it ensures that only authorised and authenticated users enter the system. Applying robust access control policies to users and accounts serves to limit the potential for exploitation in the event of a breach as it can prevent attackers from travelling through systems and finding valuable assets.<\/p>\n\n\n\n

This is particularly important when considering privileged accounts, whose elevated access and increased scope makes them especially valuable to attackers. Employing a principle of \u201cleast privilege\u201d is the best way to approach this. Users or accounts are given the lowest level of access required to perform their job \u2013 anything else is removed or restricted. Also, the often-overlooked administrator access to all devices should be managed with additional controls, such as multi-factor authentication and logging, to minimise abuse and misuse.<\/p>\n\n\n\n

Process<\/h3>\n\n\n\n

The technology element needs to be reinforced with appropriate, user-centric policies that are easy to understand \u2013 but also easy to stick to. In other words, it should be easier to do the right thing than subvert. These policies need to be enforced through monitoring and specific follow-up for non-adherence. For example, rather than hope that people download and apply patches in a timely manner, automated scripts or tools can be configured to apply these, with follow-ups to check adherence to optional updates, etc also carried out. <\/p>\n\n\n\n

People need simple channels to report anything suspicious, coupled with an understanding that they have a responsibility to do so. They should also be confident that reporting something such as clicking on a suspicious link will not result in negative consequences.<\/p>\n\n\n\n

Also, clear instructions on what to do and who to contact should someone fall victim to cyber criminals must be included. Understanding how an attack happened and taking the required action to prevent it from occurring again is key information \u2013 being updated on new threats and technologies is a crucial part of a CISO\u2019s strategy.<\/p>\n\n\n\n

Key systems (or those under the greatest threat) should be monitored continuously to detect intrusions, with alerts set up to flag anything untoward. This is helped by CISOs having a thorough understanding of their threat landscape. Knowing where they are more likely to be targeted enables control efforts to be focused effectively. Sharing cyber threat intelligence between relevant organisations keeps all parties updated on the latest security risks, thus helping to reduce the likelihood of a successful attack.<\/p>\n\n\n\n

As well as the organisation, its devices and its employees, third parties need to be part of the equation so that everyone protects data and systems to the same agreed standard. This can be done contractually if necessary.<\/p>\n\n\n\n

Human risk<\/h3>\n\n\n\n

But with roughly 90% of data breaches occurring because of phishing attacks (Cisco\u2019s 2021 Cybersecurity threat trends<\/em>), the biggest threat to an organisation\u2019s security is its people, albeit unintentionally.<\/p>\n\n\n\n

Guarding against phishing is important at any time, but particularly at this time of year in the run-up to the holiday season and online shopping events such as Black Friday and Cyber Monday<\/a>. Many people will be ordering items and expecting deliveries, making them susceptible to phishing emails related to failed or rescheduled deliveries.<\/p>\n\n\n\n

Users targeted in phishing attacks can be exploited to gain access to client systems. CISOs must therefore equip the whole workforce with the knowledge that they form a critical part of the first line of defence \u2013 as noted above, everyone has a responsibility to guard against bad actors. This requires an organisational culture in which people understand the real threat posed by cyber criminals, the potential for a ransomware attack, how to spot phishing attempts, and how to react if they notice anything suspicious.  <\/strong><\/p>\n\n\n\n

Regular, enterprise-wide, security awareness training is essential, covering topics such as cyber hygiene awareness, infosec principles, good IT practices and how to recognise suspicious emails. This can be reinforced with methods such as phishing simulations, which help employees to recognise and avoid malicious communications.<\/p>\n\n\n\n

Training needs to be tailored for different groups of users based on the specific types of attack different parts of the company are likely to face, and help employees to understand why tasks such as patching \u2013 often viewed as an inconvenience \u2013 are essential.  <\/p>\n\n\n\n

By improving security awareness across the organisation, CISOs reduce the attack surface \u2013 and, with it, the likelihood of a ransomware attack succeeding.<\/p>\n\n\n\n

To further minimise the organisation\u2019s exposure to bad actors, security awareness can be supported with technology. For example, blocking private use of corporate email addresses, or preventing access to personal emails on corporate devices, also reduces the risk of a phishing email being able to pass something into the corporate network.<\/p>\n\n\n\n

A role for everyone<\/h3>\n\n\n\n

Protecting the organisation against ransomware is an ongoing and evolving task that requires a combination of up-to-date technology, straightforward processes and informed people.<\/p>\n\n\n\n

However, while CISOs are the lynchpins that make sure the necessary blocks are in place, in an age of \u201cporous perimeters\u201d, everyone in the enterprise has a role to play in protecting their workplace from bad actors.<\/p>\n","protected":false},"excerpt":{"rendered":"

Effective ransomware handling is not simple \u2013 it must span every area of the business and requires a multi-layered approach. To achieve this, CISOs need to focus on providing all employees and the organisation with the necessary \u201ctools\u201d to recognise and react appropriately to an attack and prevent it from succeeding.<\/p>\n

Effective\u00a0ransomware\u00a0handling is not simple \u2013 it must span every area of the business and requires a multi-layered approach. To achieve this, CISOs need to focus on providing all employees and the organisation with the necessary \u201ctools\u201d\u00a0to recognise and react appropriately\u00a0to an attack and prevent it from succeeding.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4,5,3],"tags":[13,21,20,12,14,7],"class_list":["post-71","post","type-post","status-publish","format-standard","hentry","category-article","category-computerweekly","category-published","tag-human-risk","tag-people-process-technology","tag-ransomware","tag-security-think-tank","tag-training-and-awareness","tag-turnkey"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/paGq19-19","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/71","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=71"}],"version-history":[{"count":5,"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/71\/revisions"}],"predecessor-version":[{"id":106,"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/71\/revisions\/106"}],"wp:attachment":[{"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=71"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=71"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/closehelmsecurity.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=71"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}