It is clear that remote working is here to stay. According to a survey conducted by Bayt.com, a leading job site in the Middle East, 90% of professionals in the Middle East and North Africa (MENA) region expect remote work to increase over the next few years and 74% of professionals prefer jobs that allow them to work remotely. The shift to a remote workforce has redefined the way organisations structure their business models. As executives reestablish work policies to accommodate remote employees well beyond the initially anticipated duration, a new era of work will emerge: the hybrid workforce, one more largely split between office and remote environments. While this transition brings a wave of opportunity for organisations and employees, it also opens new doors for bad actors to capitalise on strained IT departments who have taken on additional responsibility to ensure sensitive data remains secure, whether on or off the corporate network.
While threats to company data range in attack method, ransomware continues to be the most prominent risk known to organisations worldwide, with a 41% increase in 2019 alone. According a recent study by Sophos, 49% of the organisations surveyed in UAE mentioned a ransomware attack in the last year. In July this year, researchers at cybersecurity firm Palo Alto uncovered a strain of ransomware that hit government-run organisations in the MENA region. It’s important that companies focus on acknowledging this threat and deploying strategies to prepare, defend and repair incidents, before adapting to a hybrid workforce model. This process will prevent organisations from falling victim to attacks where data loss or ransom payment are the only unfortunate options. To win the war on ransomware, organisations should incorporate a plan for IT organisations that ensures they have the resilience needed to overcome any attack. Let’s explore three crucial steps for ransomware resilience in more detail.
Focus on education first, avoid reactive approaches to threats later
Education – beginning after threat actors are identified – should be the first step taken on the path towards resilience. To avoid being caught in a reactive position, should a ransomware incident arise, it’s important to understand the three main mechanisms for entry: internet-connected RDP or other remote access, phishing attacks and software vulnerabilities. Once organisations know where the threats lie, they can tactfully approach training with strategies to refine IT and user security, putting additional preparation tactics in place. Identifying the top three mechanisms can help IT administration isolate RDP servers with backup components, integrate tools to assess the threat of phishing attacks to help spot and respond correctly, and inform users on recurrent updates to critical categories of IT assets, such as operating systems, applications, databases and device firmware.
Additionally, preparing how to use the ransomware tools in place will help IT organisations familiarise themselves with different restore scenarios. Whether it be a secure restore process that will abort when malware is detected or software that can detect ransomware ahead of restoring a system, the ability to perform different restore scenarios will become invaluable to organisations. When an attack does happen, they will recognise, understand and have confidence in the process of working towards recovery. By taking the education aspect of these steps seriously, organisations can decrease the ransomware risks, costs and pressure of dealing with a ransomware incident unprepared.
Implement backup solutions that maintain business continuity
An important part of ransomware resiliency is the implementation of backup infrastructure to create and maintain strong business continuity. Organisations need to have a reliable system in place that protects their servers and keeps them from ever having to pay to get their data back. Consider keeping the backup server isolated from the internet and limit shared accounts that grant access to all users. Instead, assign specific tasks within the server that are relevant for users and require two-factor authentication for remote desktop access. Additionally, backups with an air-gapped, offline or immutable copy of data paired with the 3-2-1 rule will provide one of the most critical defences against ransomware, insider threats and accidental deletion.
Furthermore, detecting a ransomware threat as early as possible gives IT organisations a significant advantage. This requires tools in place to flag possible threat activity. For endpoint devices displaced remotely, backup repositories that are set up to identify risks will give IT further insight into an incredible surface area to analyse for potential threat introduction. If implementations don’t prohibit attacks, another viable option is encrypting backups wherever possible for an additional layer of protection – threat actors charging ransom to prevent leaking data do not want to have to decrypt it. When it comes to a ransomware incident, there isn’t one single way to recover, but there are many options aside from these that organisations can take. The important thing to remember is that resiliency will be predicated on how backup solutions are implemented, the behaviour of threat and the course of remediation. Take time to research the options available and ensure that solutions are implemented to protect your company.
Prepare to remediate an incident in advance
Even when there are steps in place that leverage education and implementation techniques to combat ransomware before an attack hits, organisations should still be prepared to remediate a threat if introduced. Layers of defence against attacks are invaluable, but organisations need to also map out specifically what to do when a threat is discovered. Should a ransomware incident happen, organisations need to have support in place to guide the restore process so that backups aren’t put at risk. Communication is key, having a list of security, incident response, and identity management contacts in place if needed – inside the organisation or externally – will help ease the process towards remediation.
Next, have a pre-approved chain of decision makers in place. When it comes time to make decisions, like whether to restore or to fail over company data in an event of an attack, organisations should know who to turn to for decision authority. If conditions are ready to restore, IT should be familiar with recovery options based on the ransomware situation. Implement additional checks for safety before putting systems on the network again – like an antivirus scan before restoration completes – and ensure the right process is underway. Once the process is complete, implement a sweeping forced change of passwords to reduce the threat resurfacing.
The threat that ransomware poses to organisations both large and small is real. While no one can predict when or how an attack will happen, IT organisations that have a strong, multi-layered defence and strategy in place have a greater chance for recovery. With the right preparation, the steps outlined here can increase any organisation’s resiliency – whether in office, remote or a combination of the two – against a ransomware incident and avoid data loss, financial loss, business reputation damage or more.
Discussion about this post