Practical Ways to Reduce Ransomware Impact: Actions You Can Take Today

| May 13, 2019

article image
During the past year, Cisco Security Incident Response Services has provided emergency incident response services for many customers dealing with incidents that sometimes become a ransomware event. In many cases, we were engaged by the company at the first sign of trouble and were able to help contain the initial incident and reduce the ability of the attacker to shift to a ransomware phase. In other incidents, we were asked to help long after the attackers were in the environment and the systems were already encrypted. If we follow the standard attack lifecycle (Figure 1), the first step that we need to consider is how we would address the initial attack vector. For this blog post, let us assume the initial access vector is email (which we have observed is often the case). Initial Attack The first thing to consider is intelligence-based email monitoring and filtering. An example of this would be the Cisco Email Security Appliance (ESA) product which integrates Cisco Talos threat intelligence into an active email inspection platform.

Spotlight

QuoScient

Built by operators for operators, QuoScient provides customers across all industries with its technology QuoLab and expertise against digital threats of all kinds. With our holistic Digital Active Defense approach we empower our customers against digital threats of all kinds. Digital Active Defense is the interaction of Intelligence Operations, Security Operations, and Defense Technology working in unison to deliver proactive defense against threats. Intelligence Operations alert our customers to current and emerging threats specifically targeting their organization.

OTHER ARTICLES

We Need to Improve Cybersecurity Standards in Space

Article | February 27, 2020

Last month, SpaceX became the operator of the world’s largest active satellite constellation. As of the end of January, the company had 242 satellites orbiting the planet with plans to launch 42,000 over the next decade. This is part of its ambitious project to provide internet access across the globe. The race to put satellites in space is on, with Amazon, UK-based OneWeb and other companies chomping at the bit to place thousands of satellites in orbit in the coming months. These new satellites have the potential to revolutionise many aspects of everyday life – from bringing internet access to remote corners of the globe to monitoring the environment and improving global navigation systems. Amid all the fanfare, a critical danger has flown under the radar: the lack of cybersecurity standards and regulations for commercial satellites, in the US and internationally. As a scholar who studies cyber conflict, I’m keenly aware that this, coupled with satellites’ complex supply chains and layers of stakeholders, leaves them highly vulnerable to cyberattacks.

Read More

Progress Is the Promise in National Cybersecurity Strategy

Article | March 23, 2020

How can progress be measured when it comes to shifts in national security strategy and practice? Several assessment variables might include changes in official national guidance, legal authorities, types of campaigns or operations, lexicon used in national security discourse, and early results of the application of those changes. Since 2016, with the introduction of the construct of persistent engagement and the subsequent development of defend forward, all these variables have changed in a positive manner.

Read More

NATO Adds Cyber Commitments, Potential Ransomware Response

Article | August 30, 2021

As President Biden prepared to meet with Russian President Putin this past week in a high-profile summit in Geneva, Switzerland, cyber-attacks originating from criminals within Russia were near the top of a list of contentious issues on the agenda. However, there were important events that received minimal media attention that strengthened the U.S. President’s position. President Biden walked into those meetings with something new and bold: the strong backing of NATO countries on a series of new cyber commitments. In a NATO Summit held in Brussels on June 14, 2021, the heads of state and government participating in the meeting of the North Atlantic Council reaffirmed their unity and commitments on a long list of mutual defense topics. And there was also a major new commitment discussed in the press release — cyber-attacks against critical infrastructure within any NATO member country were now on the table. That is, online (Internet-based) attacks could result in the same response as physical attacks (with guns and bombs.) Yes, this is a very significant global development which highlights another way that the physical world and online world are merging fast, with ramifications in both directions. HOW DID WE GET TO THIS MOMENT? The ransomware attacks that recently struck critical infrastructure companies such as Colonial Pipeline and JBS resulted in more than just long lines for gas and meat price hikes. It raised alarm bells in countries all over the globe regarding the susceptibility of the majority of countries to ransomware and other forms of malware. These ransomware incidents led to NATO’s new Comprehensive Cyber Defense Policy. The big news: Cyber-attacks against critical infrastructure might (on a case-by-case basis) now trigger the famous Article 5 clause. “The Parties agree that an armed attack against one or more of them in Europe or North America shall be considered an attack against them all and consequently they agree that, if such an armed attack occurs, each of them, in exercise of the right of individual or collective self-defense recognized by Article 51 of the Charter of the United Nations, will assist the Party or Parties so attacked by taking forthwith, individually and in concert with the other Parties, such action as it deems necessary, including the use of armed force, to restore and maintain the security of the North Atlantic area. …” Here are two sections I’d like to highlight from last week’s communiqué (take special notice of section in bold): “In addition to its military activities, Russia has also intensified its hybrid actions against NATO Allies and partners, including through proxies. This includes attempted interference in Allied elections and democratic processes; political and economic pressure and intimidation; widespread disinformation campaigns; malicious cyber activities; and turning a blind eye to cyber criminals operating from its territory, including those who target and disrupt critical infrastructure in NATO countries. It also includes illegal and destructive activities by Russian Intelligence Services on Allied territory, some of which have claimed lives of citizens and caused widespread material damage. We stand in full solidarity with the Czech Republic and other Allies that have been affected in this way. “Cyber threats to the security of the Alliance are complex, destructive, coercive and becoming ever more frequent. This has been recently illustrated by ransomware incidents and other malicious cyber activity targeting our critical infrastructure and democratic institutions, which might have systemic effects and cause significant harm. To face this evolving challenge, we have today endorsed NATO’s Comprehensive Cyber Defence Policy, which will support NATO’s three core tasks and overall deterrence and defence posture, and further enhance our resilience. Reaffirming NATO’s defensive mandate, the Alliance is determined to employ the full range of capabilities at all times to actively deter, defend against and counter the full spectrum of cyber threats, including those conducted as part of hybrid campaigns, in accordance with international law. We reaffirm that a decision as to when a cyber-attack would lead to the invocation of Article 5 would be taken by the North Atlantic Council on a case-by-case basis. Allies recognize that the impact of significant malicious cumulative cyber activities might, in certain circumstances, be considered as amounting to an armed attack. We remain committed to act in accordance with international law, including the UN Charter, international humanitarian law and international human rights law as applicable. We will promote a free, open, peaceful and secure cyberspace, and further pursue efforts to enhance stability and reduce the risk of conflict by supporting international law and voluntary norms of responsible state behavior in cyberspace.” MEDIA COVERAGE OF NATO ANNOUNCEMENTS Global media coverage leading up to this NATO Summit was rather limited, especially when compared to the U.S.-Russia Summit and many of President Biden’s other European meetings – such as the G7 Summit and the his meeting with Queen Elizabeth II. Nevertheless, Meritalk offered this article: “Cybersecurity, Ransomware Climb Policy Ladder at NATO, G-7 Meetings,” which said, “cybersecurity in general, and ransomware in specific, climbed high onto the ladder of major policy issues at both the weekend meeting of G-7 nations this weekend, and the NATO Summit that concluded on June 14. “The increasing importance of cybersecurity on the national stage tracks with U.S. policy in recent months, including federal government responses to major software supply chain cyber assaults and ransomware attacks against U.S. critical infrastructure sector companies that are believed to have originated from organizations based in Russia. President Biden has promised to confront Russian President Vladimir Putin with cybersecurity and ransomware issues when the two leaders meet on June 16. …” Also, Info security Magazine ran an excellent piece entitled: “NATO Warns it Will Consider a Military Response to Cyber-Attacks,” which said, “NATO has warned it is prepared to treat cyber-attacks in the same way as an armed attack against any of its allies and issue a military response against the perpetrators. “In a communique issued by governments attending the meeting of the North Atlantic Council in Brussels yesterday, the military alliance revealed it had endorsed a Comprehensive Cyber Defence Policy, in which a decision will be taken to invoke Article 5 “on a case-by-case basis” following a cyber-attack. Under Article 5 of the NATO treaty, first signed in 1949, when any NATO ally is the victim of an armed attack, it will be considered an attack on all alliance members, who will theoretically take any actions necessary to defend that ally….” When I posted this NATO cyber topic on LinkedIn, the responses were all over the map. You can join that discussion here. Here are a few comments worth noting: Michael Kaiser, president and CEO at Defending Digital Campaigns: “Attribution better be 110 percent.” Paul Gillingwater, management consultant, Chaucer Group: “A cyber counter-attack *is* a military response. It's now one battlefield, from sea, land, air, space to cyberspace. Next: your AI will be trying to persuade my AI that it was actually a pacifist.” Kaushik (Manian) Venkatasubramaniyan, project manager, Global Business Research (GBR): “These kind of cyber-attacks targeting hospitals etc. are acts of war anyway.” FINAL THOUGHTS ON IMPORTANCE OF NATO ANNOUNCEMENT For many years, cyber pros have been talking about a “Cyber 9/11” or “Cyber Pearl Harbor.” Many experts still believe that those major cyber incidents are inevitable. Still, “smaller” cyber-attacks are now happening all the time all over the world — with very serious consequences. Bad actors are asking for larger ransoms and causing more harm. Ransomware is evolving, and future cyber-attacks may not be ended by paying a ransom to the cyber criminals. With many cyber-attacks against governments, hospitals and now critical infrastructure like gas pipeline companies and food processing plants taking place, new government actions were a must. These ransomware attacks via different types of malware are becoming more frequent and serious, and are a growing global challenge for public- and private-sector leaders. Many questions must be answered quickly, such as: Where are the “red lines” that cannot be crossed? Once the lines are identified, what happens if they are crossed? When does a cyber-attack become an act of war? Make no mistake, NATO’s new policy on cyber-attacks against critical infrastructures is a big deal. Expect more ransomware attacks to occur and those global commitments for action to be tested in the years ahead. Article Orginal Source: https://www.govtech.com/blogs/lohrmann-on-cybersecurity/nato-adds-cyber-commitments-potential-ransomware-response

Read More

Cybersecurity in Digital Marketing: Tips to Overcome Challenges

Article | August 9, 2021

No matter what business you run, digital marketing is crucial to reach out to people and generate leads today. Businesses of all sizes rely on digital marketing to take the business to the next level.Digital marketing in many forms, such as search engine optimization, social media marketing, email marketing, content marketing, and online advertisements, have been utilizing to bridge the gap between business and customers. Technology is evolving and is expected to be transformed further. As technology gets improved every second, online advertising and marketing opportunities are also getting amplified. However, the villain, cyber threats and attacks, can jeopardize your business dreams and opportunities. Yes, alarmingly, cybersecurity in digital marketing has become a serious concern today. The more the opportunity you have in digital marketing, the more you become vulnerable to cyber threats and attacks. Cybersecurity in Digital Marketing-Importance Cybersecurity is very significant as digital marketing heavily depends upon data and information, which are sensitive and confidential to your business. This confidentiality is to be maintained to retain your customers. If your business is affected by cyber-attacks, your customers lose trust in you and your business. That is because the customers think their data and information could be compromised or stolen. Therefore, you need a strong cybersecurity practice to save you and your customers from breaches and malware attacks. Apart from information loss, financial loss, loss of brand reputation, etc. too, can happen. Ultimately you may end up witnessing a crippling loss in your business. Thus cybersecurity in digital marketing is essential as threats and attacks are detrimental to your business. Cybersecurity in Digital Marketing- Challenges As all businesses are going digital now, cyber threats are expected to increase. As a result, according to Gartner, the information security market is projected to grow to US$170.4 billion in 2022. This warns businesses to be extra alert regarding the startling rate of cyberattacks. Organizations have to be ever ready with solutions. There are a lot of challenges faced by cybersecurity in digital marketing. Email marketing is an essential and powerful part of digital marketing. Email marketers face the challenges, such as phishing. Small businesses are the main targets of phishing activity as they are unaware of it. Hackers may send spam using your email accounts with virus-infected emails. Occurring continuously, the server may backlist or block your site, affecting your email campaign. Customers will lose trust in you. Content marketing is also vulnerable to cyber-attacks as hackers are well aware of content management systems (CMS) and how it works. Therefore, they can easily hack it and distribute malware. In addition, social media marketing is vulnerable to identity theft. In case a hacker cracks your password, he can do unimaginable damages to you and your business. The hacker can do unauthorized downloads, share your confidential data and information, and even exploit your customers. The above-mentioned are some of the cybersecurity challenges in digital marketing. In addition, e-commerce and customer relationship management (CRM) systems are also prone to cyberattacks and threats. Therefore, it is essential to take necessary cybersecurity measures to overcome becoming the prey of cybercriminals while performing digital marketing activities online. Overcoming Cybersecurity Challenges in Digital Marketing As businesses began to use digital marketing widely to reach out to customers successfully, organizations started getting exposed to cybersecurity threats. The consequences of breaches and malware attacks can be far-reaching. Therefore, it's high time for businesses to be ready to tackle these cybersecurity issues in digital marketing. The following tips may help companies to do it proactively. Training Your digital marketing executives are vulnerable to cyberattacks, especially those who are handling email marketing. To protect your campaigns, train all how to recognize a phishing email. Also, encourage them to use spam filters and strong passwords. SSL to Secure CRM Installing an SSL(Secure Sockets Layer) protocol on the website makes your data transfer secure and encrypted, eliminating the chances of hackers getting access. Also, your Customer Relationship Management (CRM) system should have strict data security policies. It helps you keep your data protected while your staff access sensitive data. Regular Data Backup Data loss can happen in many circumstances, such as ransomware attacks, hard drive damage or crash, or malware hijacking. These data losses will result in losing you a lot of money. Thus, encourage your staff to backup all data regularly in a different location other than your system. It will protect 100% of your data in case of cyber-attacks and system malfunction. Integrating Security Features As part of content marketing, businesses use Content Management Systems (CMS) to upload, edit easily, and publish different forms of content. However, as hackers are very familiar with CMS, they can damage your reputation by distributing malware if they hack your site. Thus, it is very much crucial to integrate security features in your CMS platform. In addition, many vulnerabilities could be closed off by installing security plug-ins. The following security measures also can be taken regarding your CMS. Use strong password Change the default admin login URL Do not use public Wi-Fi networks to access your CMS These cybersecurity measures in digital marketing are necessary as content marketing is part and parcel of the process. Regular audits Ensuring cybersecurity is a team effort and is a continuous process. The set-and-forget policy will not work with cybersecurity. Your company's measures taken regarding cybersecurity in digital marketing have to be audited regularly to ensure your cybersecurity goals are met correctly. The audit should be done at least once a quarter. Summing Up It is a time-consuming process to devise strategies to protect businesses from cyber-attacks and threats. However, unless you take necessary measures in time, your business can be jeopardized, losing clients, money, and reputation. Cybersecurity threats in digital marketing are expected to increase as technology is getting transformed every second. A stitch in time saves nine! Frequently Asked Questions Why is cybersecurity so important in digital marketing? Cybersecurity benefits your brand by protecting your website and each of your digital marketing activities. It saves all your data as well as the data of your clients. However, cyber-attacks can be detrimental to your business. What is the biggest problem in digital marketing? Apart from standing out from the competitors, the biggest problem in digital marketing is cyber-attacks and threats. Unfortunately, cyberattacks can jeopardize your business. { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{ "@type": "Question", "name": "Why is cybersecurity so important in digital marketing?", "acceptedAnswer": { "@type": "Answer", "text": "Cybersecurity benefits your brand by protecting your website and each of your digital marketing activities. It saves all your data as well as the data of your clients. However, cyber-attacks can be detrimental to your business." } },{ "@type": "Question", "name": "What is the biggest problem in digital marketing?", "acceptedAnswer": { "@type": "Answer", "text": "Apart from standing out from the competitors, the biggest problem in digital marketing is cyber-attacks and threats. Unfortunately, cyberattacks can jeopardize your business." } }] }

Read More

Spotlight

QuoScient

Built by operators for operators, QuoScient provides customers across all industries with its technology QuoLab and expertise against digital threats of all kinds. With our holistic Digital Active Defense approach we empower our customers against digital threats of all kinds. Digital Active Defense is the interaction of Intelligence Operations, Security Operations, and Defense Technology working in unison to deliver proactive defense against threats. Intelligence Operations alert our customers to current and emerging threats specifically targeting their organization.

Events