Magazine menu Close Magazine menu

Threat intelligence

Latest stories

cybersecurity new team sport

Why cybersecurity is the new team sport

  • min read
    • The pace of technological change is accelerating, and we readily adopt its many advantages. But despite this massive technological change, approaches to the threats it brings have changed little. The result is, we're losing the battle against constant attacks and breaches. For CEOs and Chief Information Security Officers (CISOs,) history may supply an answer – not in the form of technological genius, but in the form of humanity. Our recent history and deepest past show why cybersecurity must become the new team sport. The futuristic wild west of IT When I started working with computers in the early 1980s, they were controlled by men with beards in woolen tank tops. They ruled from a refrigerated IT throne – refrigerated because the IT team would often share the room with servers that need to be kept cool – knowing everything that went on in their realm. If something happened that was not allowed, it was fixed and hidden from the outside world with a combination of embarrassment and corporate secrecy. Today, we're in more of a futuristic wild west. The business perimeter contains many more applications, devices and entry points. Specialist 'gun slingers' – in the form of CISOs – have the IT administrator's security responsibilities. Each tries their best to cope with the onslaught of potential threats – anything from a nation-state attack to an employee accidentally sending data somewhere they shouldn't. Start-up mentality not all it's cracked up to be "Fail fast" and "move fast and break things" are often hailed as mantras of tech start-up success. But history also shows bad people have these same mentalities. They don't worry about due diligence or putting new ideas and technologies through rigorous testing. They try anything they think will work without considering if it will breach compliance. Meanwhile, budget, resources and red tape often tie CISO hands. They can feel held hostage by a board that doesn't understand the need for rapid reaction to combat the latest advance in 'dark tech.' We've seen this challenge before Up to now, I've described a futile, dystopian, 'Mad Max' world. But I think the battles CISOs fight today are our history, not of our future. Companies, and those in cybersecurity, often call their critical data and intellectual property the 'crown jewels,' referencing the ceremonial treasures acquired by English kings and queens. Those crown jewels are protected by thick walls, with guards and few entry points – like how IT administrators guarded our data back in the 80s. CISOs are inevitably 'outgunned,' under-resourced and underfunded in a battle against an agile and risk-indifferent enemy. So how do we 'fight the good fight' and win? Again, history has answers. Early 1900s business theorist Harrington Emerson is sometimes paraphrased, "Methods are many, principles are few. Methods may change, but principles never do." So let's go back to first principles. We're stronger together Humans first formed settlements as they started farming some 14,000 years ago. Having individuals in these settlements with different skillsets and abilities facilitated their growth. Some of us have an aptitude for the cerebral, like designing and inventing. Others are more physical, excelling in building and protecting. Settlements developed when we used complementary skills to advance a common goal, like making a safer, more prosperous place to live. Settlements collaborated – sometimes merging, sometimes building coalitions. And in times of crisis, while a few favored 'everyone for themselves,' most joined together for the greater good. Charles Darwin said, "It is the long history of humankind (and animal kind, too) that those who learned to collaborate and improvise most effectively prevailed." History has countless examples of international teamwork, from expeditions into unchartered territory to the allied nations of World War II, and more recent history. COVID-19: Each taking on a little During the recent COVID-19 pandemic, as individuals, we took precautions to keep ourselves and our families safe. But our actions of self-isolation, social distancing and complying with lockdowns knowingly served to protect society. Some countries legally enforced these measures. In others, it was a request. Regardless, most adhered, each playing their part by taking on a little of the responsibility to keep everyone safe. Eventually, the infection rate dropped and with much help from modern medical science, the world could open up. During the pandemic, countries teamed up, sharing information about infections – different strains, different consequences and symptoms. The data grew as individuals and teams combined findings, leading to the creation of vaccines to reduce the impact of the virus. It didn't stop there – sharing goes on, so vaccines can be tweaked to ensure continued efficacy. Extrapolating from this, the roadmap for cybersecurity should see the CISO as part of a team – not just within one organization, but within a global network, openly sharing intelligence and insight. On the other side of the planet, a CISO who has seen similar adds more context. As the chain passes from CISO to CISO, value increases. Quantity and depth of data grow, like crowdsourced security. This level of open collaboration may sound far-fetched, but intelligence agencies worldwide have shared information on threats similarly since September 11, 2001. This operating model may be closer than we think. CISOs already attend lunches or drinks where they swap 'war stories' under the Chatham House rule: You may use the information, but you may not disclose its source. Cybersecurity researchers in different companies and institutions worldwide combine their findings, writing shared reports. We already collaborate this way, instinctively reaching out for help, as we did in the days of early human settlements, but mostly we do it individually. Corporate legalities and organizational culture tend to restrict rather than encourage inter-company information exchange – it doesn't have to be that way. History shows collaboration naturally happens between groups with a common cause, and today is no different. By encouraging CISOs, staff and researchers to exchange knowledge and skills through a system for sharing threat information, we can nurture the communication of cooperation. We are better together, and together we can play the new team sport of cybersecurity.
cyber threats business 2022

Five business cyberthreats taking center stage in 2022

  • min read
    • Every year, businesses face a changing threat landscape. It pays for leaders to know what the experts think will come next. If you're upgrading your cybersecurity or looking for a new vendor, knowing what attacks are likely in 2022 will help you make the right choice. It turns out our predictions for 2021 were on the money. So what should you and your colleagues plan for this year? We're forecasting these four events that could have flow-on effects for other industries. 1.  Financial organizations will face more threats around cryptocurrency Cryptocurrency keeps growing, and people will keep investing in it for many reasons, including its anonymity, which also makes it attractive to cybercrime groups. In the scramble for cryptocurrency investment opportunities, cybercriminals will use social engineering campaigns, fabricating and selling rogue devices with backdoors to steal financial assets. More financial industry cyberthreats we'll see in 2022 2.  Fake medical documentation will trouble healthcare We saw the trade in faked medical documents like COVID-19 vaccination passports and test results in 2021. Fake vaccines were even spotted for sale on the dark web. As more countries roll out privileges alongside vaccination or test documentation, criminals will roll out more fakes. Medical-themed bait has long featured in cybercrime. With the pandemic triggering increased use of online medical services, patients watch for notifications about test results and messages from doctors. More healthcare cyberthreats likely in 2022 3.  Governments will conflict and compromise with big tech Governments are wary of big tech's growing power and data hoarding. As states build more digital infrastructure for delivering services and deeper insights into their population, they'll show more interest in what citizen data big business holds. We'll see more regulation, such as privacy and data localization laws, and regulation around how law enforcement can access data. Apple's new system that scans devices for child abuse images shows the challenges of balancing user privacy against stopping crime. More privacy predictions for 2022 4.  Industrial attacks will become more focused In many parts of the world, a rapidly snowballing trend is laser-focused attacks, particularly on Industrial Computer Systems (ICS.) We've seen increasing theft of authentication data using spyware, with each attack directed at only a handful of targets. We think these kinds of attacks will make up an even greater portion of the threat landscape in 2022, and we'll see the tactic used more widely. These attacks show why industrial shop floors must be protected. Industrial internet of things (IIoT) devices are easily overlooked and often vulnerable. More predictions for industrial cybercrime in 2022 5.  Ransomware attacks will get more targeted 2021 was a big year in ransomware, with a 30 percent growth in Ransomware 2.0, also known as double extortion. These attacks go beyond demanding a ransom to de-encrypt systems to using stolen sensitive data as leverage to pressure victims to pay up. In November 2021, the US FBI warned ransomware actors are "using significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections." At these times, any leaked information could have devastating consequences, making victims more inclined to pay ransoms. In 2022, this type of extortion will become more common. Regular, high-quality cybersecurity training for all staff is one of the best ways of avoiding falling victim to ransomware. Kaspersky is one of several organizations behind the No More Ransom initiative, providing free decryption tools and advice for ransomware victims. More on ransomware activity in 2021 As your strategic plans for 2022 take shape, improving cybersecurity will no doubt be among them. Your business must adapt as cybercriminals' ways and means change. These predictions will help you and your team be forewarned and forearmed.
cybersecurity predictions 2021

What does 2021 have in store for cybersecurity?

  • min read
    • Predicting the future is notoriously precarious. Who would have foreseen a year like 2020? Kaspersky's Global Research and Analysis Team reflect on this year in cybercrime and deduce what we should expect in 2021. Leaked patient records and COVID pressures in healthcare 2020 was the year everyone had a vested interest in new medical technologies' success. Cybercriminals attacked medical devices, hospitals and research institutions, intent on stealing COVID-19 vaccine insights. We also saw the first known directly fatal cyberattack: A patient died because ransomware infection of medical equipment caused care delays. Other cybercrime groups surprised us by ruling out attacking medical institutions. The cybersecurity community set up CTI League: Experts helping medical organizations respond to cyberthreats. Kaspersky gave healthcare organizations free access to tailored cybersecurity. In 2021, expect more attacks on COVID-19 vaccine developers attempting to steal critical data that could help other nations get ahead. Private healthcare organizations will further come under attack, as many don't have the resources to protect valuable patient data. With the transition to cloud computing, we may see patient data leaks from cloud services. Criminals can use personal data in hacked medical records to dupe people into revealing more. More healthcare industry cybersecurity predictions for 2021 Cybercriminals have learned about industrial networks Attacks on industrial networks will become more targeted. By watching randomly infected machines, cybercrime groups have learned organizations' IT setup and know how to exploit it. They can then on-sell network access to more sophisticated cybercrime groups who will take control of finance systems to steal cash. As many industrial control systems (ICS) use old operating systems, the end of support for systems like Windows 7 creates an exploitable loophole. We could see another significant, multi-industry crime campaign like WannaCry. As utilities and government services go through digital transformation they're more vulnerable to attack. Cybercriminals can use a government service as an entry point into industrial systems to disrupt services like public transport. In 2020, COVID-19 restrictions on working on-site delayed IT-system upgrades. During an attack, it may be harder for IT admins to regain system control quickly. Basic malware could spread and become more serious. Upgrading endpoint security and training workers are vital. More industrial cybersecurity predictions for 2021 Online education revolution brought new threats Education changed abruptly in 2020. 1.5 billion students took classes from home. Educators had to learn new skills, like running a class on Zoom or using TikTok lessons. For those who can access the technology, these new services enhance education. But they come with new threats. Learning management systems (LMS) like Google Classroom are exploding. And with growth comes cybercrime. We saw a staggering 20,000 percent growth in threats to online learning platforms between 2019 and 2020. Privacy usually involves getting the user's consent, but a child can't easily manage their privacy settings. Video will keep growing as a learning tool. About 60 percent of teachers use YouTube in the classroom. There's increased risk of exposure to age-inappropriate content, and new threats like Zoombombing could expose learners to harmful content. Games like Minecraft are a great way to make learning more interactive but exposes students to risks like cyberbullying, trolls and malicious files. Teachers must moderate content in their learning management systems, but with the popularity of social platforms and games for pupil engagement, the challenge has leveled-up. More education cybersecurity predictions for 2021 Poverty driving more financial cybercrime in 2021 In 2021, financial companies became less secure thanks to due hastily deployed remote working solutions. Some bought retail laptops that didn't match the security standards of the organization. Limited employee training, default configurations and remote access all contributed to increased attacks. There's rising extortion using distributed denial of service (DDoS) and ransomware. Targeted ransomware is the new normal for financial organizations. Criminals increased ransoms, emboldened by successful attacks and media coverage. To cover their tracks, they'll now expect you to pay in cryptocurrencies. People are often the weakest link, like in the failed attempt to infiltrate Tesla. Stay at home orders didn't affect cybercriminals: Brazilian cybercrime groups went global in 2020, expanding to Europe and beyond, including attempts to hack ATMs. Bigger crime groups are evolving their business models to boost profits by hiring more people within their virtual walls rather than outsourcing. To crack down on cybercrime, the US Department of the Treasury's Office of Foreign Assets Control warned of sanctions for organizations facilitating ransom payment. Next, we predict sanctions against institutions and nations that don't combat cybercrime coming from their territory. More financial cybersecurity predictions for 2021 Crime gangs collaborating on advanced threats Advanced persistent threats (APTs) are the most dangerous kind of attacks, often seen in geopolitical clashes, intent on harming national interests. With the trend towards improved organization security and more people working from home, crime groups will exploit network technologies such as virtual private networks (VPNs,) using social engineering to get access. 5G is big news, with bogus stories of health risks and some nations limiting or banning Huawei products in their 5G infrastructure. Security researchers are examining Huawei and other 5G providers for implementation flaws. If found, they'll make the front pages. As more devices depend on 5G for connectivity, attackers will have more incentive to seek vulnerabilities to exploit. As ransomware becomes the weapon of choice for many criminals, we may see ransomware players' concentrate. In 2020 the Maze and Sodinokibi gangs pioneered an affiliate collaboration model. These bigger groups may combine to deliver APT-style attacks that overwhelm a target organization's system, to access specific data. We'll likely see attacks like these disrupt everyday lives. It could be an intentional attack on critical infrastructure like utilities or collateral damage from ransomware targeting big organizations we all rely on, like supermarkets, mail or public transport. More advanced threat predictions for 2021 Threats may be increasing, but fortunately, there's better education, technology and intelligence available today to help your organization stay secure and face the future.
threat attribution

How to find out who’s behind a cyberattack

  • min read
    • Knowing who or what has attacked us is critical for survival. In cybersecurity, threat intelligence cuts through the noise to find the poisoned needle in your data stack, letting you act fast before damage spreads. But what if you could also find out who is behind the attack? How threat attribution helps if you've been targeted by an APT If you've been targeted by an advanced persistent threat (APT), threat attribution helps you understand the attack motive and respond quickly. The cybercrime groups that carry out APT attacks are often linked to state-sponsored attacks. It's a costly way to get to their prize. If you have something they want, you could be a target. They're advanced. No low-cost software bought on the dark web by do-it-yourself cybercriminals. They build their own sophisticated software for purposeful damage. They're persistent. They seek you as their target, hitting you with weeks or months of attacks until they break through your IT security defenses. Or they lie dormant for years until the time to attack. Once in, they conduct secret operations to find critical data. If they're determined, there's only so much that cybersecurity software can keep safe. And they're a serious threat. Their goals range from espionage to sabotage, to data theft for profit. Threat attribution wins the threat intelligence race, but it's not for everyone Threat attribution is a next-level solution, but it's not for every business. It's like choosing a car. What you need depends on your journey. A budget motor is fine for driving from A to B. In cybersecurity, that's endpoint security. If you're carrying precious cargo, a limousine may be a worthwhile investment. In cybersecurity, that's threat intelligence. If you hold classified information that's interesting to a rival state, you're at greatest risk of an APT attack. National security and law enforcement agencies (like Interpol or the FBI) are most vulnerable. They have much to gain by uncovering who's hacking them. Sometimes APT attacks also target corporates, other government agencies and critical infrastructure like power plants and manufacturing. You don't have to be a big organization to be a target. If you're making components for a military plane, a less friendly state may want to know how you're making the rudder for counter-intelligence. Supply chain attacks are also on the rise. By hitting a laptop manufacturer, hackers can infect everyone in an organization. Then, when the time's right, they strike, cherry-picking who they spy on by hacking straight into their laptop. Who are the threat actors? APTs are a fast-growing 'industry.' These threat actors are not amateurs. They're super-organized crime workers. Some have different units for espionage, counter-intelligence and financial exploitation. Lazarus was the most significant threat actor in 2019. They attacked Sony Pictures Entertainment with a data-wipe in 2014 and made several attacks on South Korea. APT trends in 2020 predict more sophisticated attacks using artificial intelligence (AI) and deep fakes to access personal data. How does threat attribution work? When one of the most damaging ever ransomware attacks WannaCry hit in 2017, a Google researcher tweeted cryptic code showing similarities between WannaCry and 2015 malware attributed to Lazarus. This is threat attribution. You need to analyze and find clues that take you back to existing knowledge. By analyzing the attack's context, and nuances and languages deep in the code, researchers can reveal the threat actor's origins. These actors rarely leave a calling card, but they do leave evidence. We can analyze malware samples never seen before to find out if the actor is new, or an existing player in disguise. Like all forensic analysis, it's slow and painstaking. With highly sophisticated threats, it means reverse-engineering the attacks. It can take years, even for teams of the most skilled researchers. That's often enough time for attackers to achieve their goals. How can we shorten the analysis time? What if we could speed up the process? Faster attribution can shorten incident response times from hours to minutes, and reduce false positives. Kaspersky's Global Research and Analysis Team (GReAT) tracks over 600 APT actors and campaigns. To help the Information Security (InfoSec) community block APTs, they produce 120 or more subscriber reports each year and share highlights in quarterly APT trends reports. Profiling each threat actor can take years, building a database of everything you need to know about them. From this insight, Kaspersky developed one of the first solutions for automated threat attribution. It's like the Shazam app – that can identify the song you're humming by finding a match – for threat intelligence. By uploading a code sample to Kaspersky's Threat Attribution Engine, it matches previous attacks and APT groups in seconds. It analyzes the malware's 'genetics' to compare to 'genotypes:' known malware linked to a threat actor. This fast analysis can help those facing APT attacks to limit damage. We can't stop the flood of threats permeating our world, but we can build our defenses. Threat attribution is a new weapon in the arsenal for tackling organized cybercrime, and it could make it far harder for them to succeed.
threat intelligence

How threat intelligence evolved, and where it will go next

  • min read
    • Cybersecurity has always been about the intelligence that powers the tools. It's this intelligence that battles the minds that make malware. The epicenter of the battle is identifying and analyzing threats, or threat intelligence. What makes it threat intelligence, rather than threat data, is analysis. To understand why threat intelligence will be so crucial in cybersecurity's future, we need to visit the museum of its evolution. More innocent times: The noughties Mulholland Drive was in cinemas; Shaggy and Destiny's Child sold CDs by the bucket. Email was standard for business, but less so for personal use. Anyone geeky enough to 'surf the net' for fun might visit an internet café to use a coveted, futurist desktop iMac. A revolution in attractive hardware, it looked like the candy-colored offspring of motorcycle helmet and refrigerator produce compartment. The precursors to threat intelligence started appearing at this time. First, there were IP and URL blacklists. Security software like Security Information and Event Management (SIEM) systems, and next-generation firewalls (NGFWs) used the blacklists to give alerts and reports. Security researchers manually searched for threats and sent daily updates to customers. The bright, new digital past: 2010 It was the year Iceland's Mount Eyjafjallajökull grounded flights across Europe with a cloud of ash. Everyone was talking about Wikileaks and the Arab spring. Facebook and Twitter had become household names, but were far less used by marketers and brands. The dark web and malign activities were exploding, showing the limits of the day's security software. It wasn't designed to process the number of Indicators of Compromise pelting down like a deluge of frogs. They couldn't identify and process the dust storms of malicious domains, IPs and other threats. The cybersecurity industry responded. Machine learning and artificial intelligence (AI) could automate and correlate data on a new scale. With millions of sensors, their data feeds netted oceans of information. They processed and analyzed it with big data tools. These systems began to be used to perform complex detection covering all attack surfaces. And the big data technology gave birth to the idea of threat intelligence. Machine meets human: 2015 It was the year of Je Suis Charlie, as many sided with French satirists against terrorism. 195 countries reached agreement over the Paris Climate Accord, but the color of a dress divided the world firmly into two camps. Security experts overseeing intelligence collection could reduce false positives and better see threats and attack methods specific to their organizations. It meant faster detection and response, and a change of emphasis to finding and prioritizing vulnerabilities. The world we now know From 2018, the threat intelligence industry ballooned. Hundreds of new companies popped up, offering targeted services focused on data quality. Their goal was to give guidelines for decisions and actions. The companies buying threat intelligence products and services started using them more effectively, for example, adapting their data collection for security needs. By 2019 the industry had adopted a shared understanding of what threat intelligence means. Bear with me – this chain has a few links. Threat intelligence means multiple sources giving relevant, targeted data. The data must be converted into information that can be immediately used. It must be integrated into an organization's security operations through a single entry point, and communicate seamlessly with their existing security controls. Its unique insights on emerging threats will let security teams prioritize alerts, maximize resources and make fast decisions. And what of 2020 onwards? The market is still growing. Research suggests threat intelligence could be worth 13 billion US dollars by 2023. Ever smaller organizations are starting to use threat intelligence. But in the main, this will be a new era of cooperation. To be more comprehensive, cybersecurity vendors are already integrating their products and services with others. Cybersecurity will move from reactive to proactive, while the role of security teams in organizations will grow. They'll interact more at all levels and with all business groups. They'll become responsible for delivering proactive threat intelligence that not only protects, but identifies risk and shapes business goals. Threat intelligence will effectively predict and prevent attacks at the earliest stage, and sooner or later, underpin the whole concept of proactive cybersecurity and organizational risk. This article was published in April, 2020.
how to ransomware factory

Ransomware: The common attack you can stop in its tracks

  • min read
    • Holding a business's systems and information for 'ransom' is an increasingly common form of cyberattack. Kaspersky research shows this type of malware attack has risen 25 percent in the past three years. Verizon's investigations agree. Their 2019 Breach Investigations Report notes, "Ransomware has become so commonplace that it is less frequently mentioned in the specialized media unless there is a high-profile target." This 'so common it's boring' phenomenon means ransomware can slip off the radar. Now's the time to plan for what your business will do to prevent and handle these common attacks. What is business ransomware? It's not those spam messages that claim to have your personal data. Ransomware is a sophisticated attack that involves a series of steps. First, a cybercriminal finds a way into an endpoint, usually using social engineering or phishing to get account credentials, or by infecting a USB memory stick. Next, they insert malware, which encrypts files and directories. Finally, the malware warns the user their machine is infected and demands a ransom to decrypt data. The attacker has often studied the target's infrastructure to understand which databases and directory services are most critical. They tie together malware products and hack in a determined order. Attackers not immediately paid now sometimes publicly post data they've taken. Industries especially vulnerable to ransomware Breach by ransomware is not usually an isolated incident. Often, there have been a series of IT security errors or less-than-ideal practices. If your business isn't offering enough cybersecurity awareness training or you have delays in patching and system updates, your risk may be higher. High-profile ransomware attacks Cybercriminals have used ransomware to attack some prominent organizations in recent years. Worming the data away Estimated to be the most costly ransomware attack to date, NotPetya (also known as ExPetr) hit both Maersk and FedEx, taking down their systems for weeks. It worked by way of a worm that wiped data, causing hundreds of millions of US dollars of damage. Now you see it; now you don't File-encrypting ransomware LockerGoga attacked Norwegian aluminum and renewable energy company Norsk Hydro. The malware had advanced features such as deleting itself when it detected virtual machines to prevent researchers analyzing it. Norsk Hydro said their good backups meant the attack wasn't as bad as it could've been, but it still cost them around 90 million US dollars. A tale of 174 cities, and counting Ransom attacks on city governments are on the increase. In 2019, cybercriminals attacked some 174 municipal organizations with ransomware – about 60 more cities than the year before. The City of Baltimore suffered two attacks in 2018 and 2019 that together cost an estimated 18 million US dollars. One of the Baltimore attacks took down the city's emergency response dispatch system. Not all patients recover Californian healthcare provider Wood Ranch Medical announced it was going out of business in late 2019, as a direct result of a ransomware attack. The ransomware had encrypted both patient records and backups. How to avoid a ransomware attack 1.  Have the right tools to understand your vulnerabilities Your IT security practice needs tools to investigate what happened in an attack and what parts of your infrastructure need updating or replacing. Are you running a rogue app or access point? Do you have unmonitored and open network ports? Are privilege escalations being tracked? Are they expected and appropriate? Understanding root causes like these means you can know your defensive posture (the security status of your networks and information, and your capability to defend it and react to changes) and monitor your incident response. 2.  Be vigilant about patching and installing updates Attackers now scour the internet looking for outdated servers and applications. Many ransomware attacks happen within days of discovering a vulnerability. To delay is to invite exploitation. Make sure your patching program covers all endpoints, both on-premises and in the cloud. 3.  Regularly test your data recovery and emergency response procedures Back up critical data and ensure backups are intact and recoverable. Practice recovery and develop the correct order for restoring data. Identify your most valuable assets and make sure they're backed up. Regularly review the list to make sure you haven't missed something. Data backups and recovery drills should be the start of an overall emergency response plan. The plan should include regular, scheduled practice exercises, both 'table top' (organized meetings with role-playing) – to iron out organizational issues, and attack simulations – to find weak links and show-stoppers that could prevent infrastructure coming back online. 4.  Start or improve your cyber awareness program and improve your overall password portfolio Weak passwords might have caused a third of 2019's ransomware attempts. Conducting regular cybersecurity awareness training helps users improve their password hygiene. Install a business-wide password manager or single sign-on tool, and put in place multi-factor authentication (MFA) for users handling private data and money-related tasks. What to do if ransomware hits your business By strengthening your cybersecurity, you'll make it harder to be held to ransom. But you can do your business a favor by planning for if it happens. 1.  Plan alternative communications Ransom victims are often immobilized because communications like corporate email, phone calls or texts may not be available. Include using alternative communication such as WhatsApp, Skype and group SMS as part of recovery drills, but bear in mind these systems may be less secure. 2.  Decide if you will pay a ransom The case for paying In the US, the FBI has softened its earlier "don't pay, ever" position in its most recent guidelines. Two cities in Florida voted to pay ransoms of 500,000 to 600,000 US dollars – likely less than the cost of restoring its systems. The case against paying Your attacker may not honor their promise. You may receive further demands. The virus may already be installed in your system. While the term 'ransom' suggests physical threat, unless you're operating critical care facilities, it's unlikely ransomware will lead to loss of life. And it may be cost-efficient the first time, but it increases the likelihood you'll be hit again. The No More Ransom project, whose members include Europol and Kaspersky, advises those attacked with ransomware not to pay. It works to reduce ransomware's impact by providing free decryption tools. Despite the growing threat, with tight security and planning, you can avoid the worst impacts of ransomware, or even getting hit in the first place. Understanding ransomware's dimensions and having regular planning exercises will mean you'll know your protective measures are up to scratch. This article was published in March, 2020.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries