Focus on the Fundamentals: 6 Steps to Defend Against Ransomware

Ransomware is the monetization of poor cyber hygiene. Here are 6 steps you can take to improve your security defenses.

Ransomware attacks have become a boardroom issue for nearly every organization. In 2020 alone, there were more than 300 million ransomware attacks recorded, an increase of more than 60% from 2019. There are many contributing factors to this trend, such as the steady rise in cryptocurrency, a sophisticated ransomware value-chain network and a proven business model with double extortion. However, one of the most important drivers of ransomware today is the vast number of software vulnerabilities and misconfigurations threat actors are able to feast on to gain a foothold inside organizations and propagate their attacks. 

Ransomware is dependent on attackers exploiting vulnerabilities

With work from home as the new normal, attackers are preying on remote access infrastructure and web application flaws for entry points into the network. REvil/Sodinokibi, the largest ransomware syndicate today, has increasingly targeted vulnerabilities in VPN (CVE-2019-11510), web server (CVE-2019-2725), remote desktop (CVE-2019-19781), and, just recently, remote IT management (CVE-2021-30116) infrastructure. Conti ransomware strains have also frequently targeted VPN systems and Remote Desktop Protocol (RDP) to gain access to victims' networks. Software vulnerabilities have become the fastest growing ransomware attack vector because of the sheer volume of CVEs published each year and the lack of any user interaction requirements to deploy the payload.

But it isn't just traditional CVE vulnerabilities that security teams should worry about. Misconfigurations play a huge role in ransomware propagation across the organization. Ransomware exploits have been targeting Active Directory (AD) weaknesses to escalate privileges and move laterally to higher value targets. The Ryuk ransomware group was able to propagate an attack from a single email to complete domain-wide infection in just over 24 hours using common AD misconfigurations. AD is often referred to as the "Keys to the Kingdom" because it is the center of the organization's authentication, authorization and access control. Once AD has been compromised, attackers can use AD — and its group policy attribute — to deploy ransomware to the entire enterprise.

Understanding where to shore up your ransomware defenses

There is both good news and bad news when it comes to defending against ransomware. 

First, the bad news: there is no silver bullet to protect your organization. There is no shiny Artificial Intelligence (AI)-based technology, advanced behavioral analytics or real-time detection/response solution that will magically solve this problem. Cyber defenders looking for a single ransomware point solution will be sorely disappointed. 

And, the good news: there is a path forward by focusing on the security fundamentals. I know what you're thinking: cyber hygiene isn't sexy or exciting. But it works. Fundamentals are essential to prevent successful ransomware attacks. Cyber experts such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.K. National Cyber Security Centre (NCSC) continuously stress the fundamentals, such as:

• Conducting cybersecurity awareness training sessions to decrease phishing attacks

• Segmenting your networks to separate various business units and resources to contain an intrusion

• Enabling Multi-factor Authentication (MFA) everywhere

• Maintaining frequent, encrypted backups of data and system images

• Performing continuous Risk-based Vulnerability Management and AD assessment of your entire attack surface


6 steps for defending against ransomware 

To help you with that last fundamental, Tenable advises taking the following six steps to improve your security defenses against ransomware. 

1. Scan often, scan everything

2. Harden AD to protect your crown jewels

3. De-escalate privilege escalation

4. Prioritize using prediction

5. Remediate like your organization depends upon it

6. Measure to improve your game


Tenable is here to help you at each step along your journey. 

Learn More 

• Read the blog: How to Measure the Efficacy of Your Cybersecurity Program: 5 Questions to Ask 

• View the webinar: Introducing Tenable.ad — Secure Active Directory and Disrupt Attack Paths

• Download the eBook: A King's Ransom: How to Stop Ransomware Spreading via AD