{"id":37716,"date":"2020-11-19T11:46:58","date_gmt":"2020-11-19T16:46:58","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=37716"},"modified":"2020-11-24T04:24:31","modified_gmt":"2020-11-24T09:24:31","slug":"structured-approach-ransomware","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/structured-approach-ransomware\/37716\/","title":{"rendered":"A structured approach to ransomware protection"},"content":{"rendered":"

For most of the past year, ransomware stories have featured regularly on news websites \u2014 and not just high-profile incidents (although there\u2019s no shortage of those). Ransomware creators are actively refining their methods and technologies. In 2020, we saw the merger of several groups into a cartel, the creation of sites for the publication of stolen materials, auctions for the sale of stolen information, and the first ransomware for Linux. More recently, news also emerged that a ransomware group had started using hacked Facebook accounts to intimidate victims.<\/p>\n

According to Krebs on Security<\/a>, a group calling itself Ragnar_Locker Team took over the Facebook page of a Chicago-based DJ, launching an ad campaign in his name. Meanwhile, announcements with the subheading \u201cRagnar_Locker Team press release\u201d pointed directly to a successful attack on beverage maker Campari Group. In them, the attackers also boasted about the amount of stolen information in their possession, threatening to publish it if Campari refused to pay the ransom demand.<\/p>\n

All this seems to confirm that ransomware authors feel untouchable and are willing to spend part of their ill-gotten gains on mastering new technical tools and pressure levers. That means antiransomware efforts require more than just a security product on a workstation. And we\u2019re not the only ones who have come to that conclusion: Gartner recently proposed the Ransomware Defense Architecture method of protection.<\/p>\n

Gartner\u2019s structured approach<\/h2>\n

Ransomware Defense Architecture combines IT systems and operations with security risk management. According to Gartner, technical professionals cannot approach ransomware defense from just one domain. Domains such as storage, networking and data protection, on-premises, in the cloud, and at the edge all have to take security into consideration when confronting a ransomware attack. Gartner sees ransomware attacks on a continuum timeline with five phases:<\/p>\n