Once someone gets data using this style of ransomware, there isn’t much you can do outside of paying the ransom or preparing to have the data released. Even if you pay the ransom, you have no guarantee the data will not be released, and you may still have some level of responsibility to report. There are preventative steps you can take. A data loss prevention (DLP) solution may alert you to attempts to exfiltrate data, but even if you have one in place you should still employ the following:
- Patching, email security, and web protection: Dealing with these attacks starts with preventing the myriad of ways they can enter an organization. This means covering a lot of the same bases you have for years—patching software vulnerabilities quickly, deploying email protection, and using web protection to prevent users from encountering malicious sites (quite a few attacks start with drive-by downloads).
- Network segmentation: Another important point here comes from segmenting portions of your customers’ networks to help prevent ransomware from spreading. You may want to cordon off the most important parts of your network to help prevent an intrusion in one area from affecting another. In simple terms, if criminals can access employee records, segmenting the network properly could prevent them from reaching customer data or give you time to detect the issue before it spreads to other parts of the corporate network.
- Endpoint protection: For attacks like these, I want to emphasize the importance of going beyond antivirus by using a full endpoint protection solution. Signature-based antivirus normally can only catch known issues. However, endpoint protection solutions cover more than just malicious files—they use artificial intelligence and machine learning to look holistically at the endpoint for odd or suspicious behavior, then either flag that to the IT professional or take a specific action. For example, if someone downloads a spreadsheet, which then launches a script that begins reaching out to other endpoints on the network or starts copying and transmitting sensitive data to another source, the endpoint protection solution can attempt to halt both actions before damage is done.
- Transparency: If you get an indication that someone has access to customer data, you should be transparent with customers about the incident. If you’re required by law to notify your customers and your regulator about the breach, you absolutely need to come clean when a breach occurs. You don’t want auditors to find out when cybercriminals publish your business’s name on a website. If there’s an indication of a data compromise, make sure you report within your reporting window. Don’t make a bad situation worse—honesty really is the best security policy.
A scary new front
For years, cybercriminals have demanded ransoms to keep quiet about data breaches. Until recently, these were mostly idle threats, but today’s reality represents a terrifying new challenge in the fight against ransomware. If you don’t want to end up on the wrong end of one of these attacks, continue employing strong security controls. And if you do face a breach, above all, be transparent with compliance officers and customers.
I mentioned endpoint protection as a key pillar of defense against these threats. SolarWinds® Endpoint Detection and Response (EDR), powered by SentinelOne®, offers AI-driven threat detection and policy-driven responses and protection. If one of your clients is hit by a traditional, encryption-based ransomware attack, EDR can automatically roll the endpoint back to a known safe state. And it’s available in SolarWinds RMM, which you can use to also manage patches, offer email protection, and run backup. Learn more today.
Tim Brown is VP of Security for SolarWinds MSP. He has over 20 years of experience developing and implementing security technology, including identity and access management, vulnerability assessment, security compliance, threat research, vulnerability management, encryption, managed security services, and cloud security. Tim’s experience has made him an in-demand expert on cybersecurity, and has taken him from meeting with members of Congress and the Senate to the Situation Room in the White House. Additionally, Tim has been central in driving advancements in identity frameworks, has worked with the US government on security initiatives, and holds 18 patents on security-related topics.
