1
00:00:00,180 --> 00:00:01,012
In this lesson,

2
00:00:01,012 --> 00:00:03,150
we're going to discuss the world of ransomware.

3
00:00:03,150 --> 00:00:06,000
Now, ransomware is the digital equivalent of kidnapping.

4
00:00:06,000 --> 00:00:07,560
But instead of focusing on people,

5
00:00:07,560 --> 00:00:10,740
we are focused on digital data and information assets.

6
00:00:10,740 --> 00:00:11,730
Let's imagine for a moment

7
00:00:11,730 --> 00:00:13,170
that somebody came over to your house today.

8
00:00:13,170 --> 00:00:14,880
They grabbed your child when you weren't home,

9
00:00:14,880 --> 00:00:17,130
and then they sent you a letter demanding $1 million

10
00:00:17,130 --> 00:00:18,870
for your child's safe return.

11
00:00:18,870 --> 00:00:21,390
This type of kidnapping is usually pretty successful

12
00:00:21,390 --> 00:00:23,340
because the victim's family will usually pay up

13
00:00:23,340 --> 00:00:25,320
to ensure the safe return of their child.

14
00:00:25,320 --> 00:00:26,220
Now, with this in mind,

15
00:00:26,220 --> 00:00:27,660
let's go back to the digital world

16
00:00:27,660 --> 00:00:29,190
and talk about ransomware,

17
00:00:29,190 --> 00:00:31,560
because ransomware is a type of malicious software

18
00:00:31,560 --> 00:00:33,750
that's designed to block access to a computer system

19
00:00:33,750 --> 00:00:36,720
or its data by encrypting it until a ransom is paid

20
00:00:36,720 --> 00:00:38,250
over to the attacker.

21
00:00:38,250 --> 00:00:40,440
Now, generally, ransomware will display a message

22
00:00:40,440 --> 00:00:42,030
to the victim that demands payment

23
00:00:42,030 --> 00:00:43,590
in exchange for a decryption key

24
00:00:43,590 --> 00:00:45,480
which can decrypt your data files.

25
00:00:45,480 --> 00:00:47,640
Some ransom amounts can be fairly low

26
00:00:47,640 --> 00:00:48,780
like a few hundred dollars

27
00:00:48,780 --> 00:00:50,790
if the attacker determines they have encrypted the files

28
00:00:50,790 --> 00:00:52,680
of an individual user system.

29
00:00:52,680 --> 00:00:55,950
But we've also seen demands in the multi-millions of dollars

30
00:00:55,950 --> 00:00:57,180
for large organizations

31
00:00:57,180 --> 00:01:00,000
that have become the victim of a ransomware attack.

32
00:01:00,000 --> 00:01:01,500
To really understand the scale

33
00:01:01,500 --> 00:01:03,930
and scope of this type of ransomware problem,

34
00:01:03,930 --> 00:01:04,769
let's just take a look

35
00:01:04,769 --> 00:01:07,200
at a relatively recent, high-profile incident,

36
00:01:07,200 --> 00:01:10,650
known as a Colonial Pipeline attack of 2021.

37
00:01:10,650 --> 00:01:13,200
Colonial Pipeline is a major US fuel company

38
00:01:13,200 --> 00:01:14,880
that fell victim to a ransomware attack

39
00:01:14,880 --> 00:01:17,010
that forced them to shut down their pipeline.

40
00:01:17,010 --> 00:01:18,780
Now, that doesn't sound so bad on the surface.

41
00:01:18,780 --> 00:01:19,980
But the problem here is

42
00:01:19,980 --> 00:01:21,720
that the Colonial Pipeline actually carries

43
00:01:21,720 --> 00:01:24,150
nearly half of the United States' fuel supply

44
00:01:24,150 --> 00:01:25,650
on the East Coast.

45
00:01:25,650 --> 00:01:27,090
Now, due to this ransomware attack

46
00:01:27,090 --> 00:01:28,470
that took over their systems,

47
00:01:28,470 --> 00:01:30,270
the company was unable to use their pipeline

48
00:01:30,270 --> 00:01:32,100
for five straight days.

49
00:01:32,100 --> 00:01:34,410
This shutdown caused massive disruptions,

50
00:01:34,410 --> 00:01:36,630
which led to fuel shortages, panic buying,

51
00:01:36,630 --> 00:01:38,910
and a pretty large spike in gas prices.

52
00:01:38,910 --> 00:01:40,860
The attackers, known as the DarkSide,

53
00:01:40,860 --> 00:01:42,600
demanded and then received a ransom

54
00:01:42,600 --> 00:01:45,690
of approximately $4.4 million in Bitcoin

55
00:01:45,690 --> 00:01:48,060
to provide the decryption key for this attack.

56
00:01:48,060 --> 00:01:49,170
While the payment facilitated

57
00:01:49,170 --> 00:01:51,030
the recovery of some of the encrypted data,

58
00:01:51,030 --> 00:01:52,980
the attackers repercussions really fell

59
00:01:52,980 --> 00:01:55,680
across industries and households for weeks.

60
00:01:55,680 --> 00:01:58,230
Luckily, during the Colonial Pipeline ransom attack,

61
00:01:58,230 --> 00:01:59,850
nobody was seriously injured.

62
00:01:59,850 --> 00:02:01,530
But that isn't always the case.

63
00:02:01,530 --> 00:02:03,210
One of the most tragic real-world examples

64
00:02:03,210 --> 00:02:05,010
of a ransomware attack actually occurred

65
00:02:05,010 --> 00:02:07,560
at the University Hospital in Dusseldorf, Germany,

66
00:02:07,560 --> 00:02:09,990
back in September of 2020.

67
00:02:09,990 --> 00:02:12,360
Back then, the University Hospital, Dusseldorf,

68
00:02:12,360 --> 00:02:15,210
suffered a ransomware attack which crippled their systems.

69
00:02:15,210 --> 00:02:16,230
Because of the attack,

70
00:02:16,230 --> 00:02:18,180
the hospital's computer systems were disrupted,

71
00:02:18,180 --> 00:02:19,650
and they began to divert patients

72
00:02:19,650 --> 00:02:22,050
who required emergency treatment to other hospitals

73
00:02:22,050 --> 00:02:23,670
while the cybersecurity team was working

74
00:02:23,670 --> 00:02:27,240
to regain access to their systems and to restore their data.

75
00:02:27,240 --> 00:02:29,370
Now, among those patients who were being diverted was

76
00:02:29,370 --> 00:02:32,010
a woman who is suffering from a life-threatening condition.

77
00:02:32,010 --> 00:02:34,110
Due to the delay caused by rerouting her ambulance

78
00:02:34,110 --> 00:02:36,450
to another hospital because of that ransomware attack,

79
00:02:36,450 --> 00:02:37,980
this woman actually died

80
00:02:37,980 --> 00:02:39,330
making this the first death

81
00:02:39,330 --> 00:02:42,480
directly linked to a ransomware attack in a hospital.

82
00:02:42,480 --> 00:02:44,640
Now, German authorities launched an investigation.

83
00:02:44,640 --> 00:02:46,140
And if the attackers were caught,

84
00:02:46,140 --> 00:02:48,090
they could have faced charges of manslaughter

85
00:02:48,090 --> 00:02:49,980
in addition to cyber crime charges

86
00:02:49,980 --> 00:02:52,560
because somebody died as a result of the attack.

87
00:02:52,560 --> 00:02:54,330
The attackers claimed they did not intend

88
00:02:54,330 --> 00:02:56,430
to target the University Hospital system,

89
00:02:56,430 --> 00:02:57,900
but instead they were targeting

90
00:02:57,900 --> 00:02:59,910
the Heinrich Heine University.

91
00:02:59,910 --> 00:03:02,100
But they attacked the hospital by mistake.

92
00:03:02,100 --> 00:03:03,240
When they learned about the mistake

93
00:03:03,240 --> 00:03:05,190
and the severe consequences of their actions,

94
00:03:05,190 --> 00:03:07,200
they provide the decryption key to the hospital

95
00:03:07,200 --> 00:03:09,270
without demanding a future ransom.

96
00:03:09,270 --> 00:03:11,340
This ransomware attack really does underscore

97
00:03:11,340 --> 00:03:13,500
just how vulnerable critical infrastructure can be

98
00:03:13,500 --> 00:03:14,790
to a ransomware attack

99
00:03:14,790 --> 00:03:16,650
and the cascading consequences

100
00:03:16,650 --> 00:03:18,360
that these ransomware attacks can have

101
00:03:18,360 --> 00:03:19,950
on our society at large.

102
00:03:19,950 --> 00:03:22,530
So now that we understand the gravity of ransomware,

103
00:03:22,530 --> 00:03:23,760
how can we protect ourselves

104
00:03:23,760 --> 00:03:25,650
and our organizations against it?

105
00:03:25,650 --> 00:03:27,300
Personally, I recommend following

106
00:03:27,300 --> 00:03:28,980
four security best practices

107
00:03:28,980 --> 00:03:31,590
to prevent becoming the victim of a ransomware attack.

108
00:03:31,590 --> 00:03:33,390
These are conducting regular backups,

109
00:03:33,390 --> 00:03:35,130
installing regular software updates,

110
00:03:35,130 --> 00:03:37,650
providing security awareness training to your end users,

111
00:03:37,650 --> 00:03:39,540
and implementing multi-factor authentication

112
00:03:39,540 --> 00:03:40,800
for your systems.

113
00:03:40,800 --> 00:03:43,530
First, you should always conduct regular backups.

114
00:03:43,530 --> 00:03:45,150
One of the most effective ways to mitigate

115
00:03:45,150 --> 00:03:47,250
against the impact of a ransomware attack is

116
00:03:47,250 --> 00:03:48,120
to regularly back up

117
00:03:48,120 --> 00:03:50,760
all of your important data, files, and systems.

118
00:03:50,760 --> 00:03:53,400
These backups should be stored both on physical devices

119
00:03:53,400 --> 00:03:55,200
in your own on-premise data center,

120
00:03:55,200 --> 00:03:56,400
as well as the second backup

121
00:03:56,400 --> 00:03:58,470
conducted using cloud-based storage solutions

122
00:03:58,470 --> 00:03:59,700
to ensure that they're not connected

123
00:03:59,700 --> 00:04:02,010
to the main system that you're trying to protect.

124
00:04:02,010 --> 00:04:04,560
For example, if you only have one external hard drive

125
00:04:04,560 --> 00:04:06,690
connected to your system that serves as your backup,

126
00:04:06,690 --> 00:04:08,820
this device will be encrypted by the ransomware

127
00:04:08,820 --> 00:04:10,740
if your system is attacked as well.

128
00:04:10,740 --> 00:04:12,300
But by having cloud-based storage

129
00:04:12,300 --> 00:04:14,880
or an offsite disconnected storage solution available,

130
00:04:14,880 --> 00:04:16,680
you're going to have a full copy of your data

131
00:04:16,680 --> 00:04:18,510
if you need to restore those from backup

132
00:04:18,510 --> 00:04:20,339
because of a ransomware attack.

133
00:04:20,339 --> 00:04:23,550
Second, you should install software updates regularly.

134
00:04:23,550 --> 00:04:25,410
By regularly updating all of your software,

135
00:04:25,410 --> 00:04:28,020
especially your operating system and antivirus programs,

136
00:04:28,020 --> 00:04:29,100
you can prevent an attacker

137
00:04:29,100 --> 00:04:30,810
from being able to exploit vulnerabilities

138
00:04:30,810 --> 00:04:33,360
and outdated software and operating systems.

139
00:04:33,360 --> 00:04:35,670
For example, the WannaCry ransomware attacks

140
00:04:35,670 --> 00:04:38,070
of 2017 were able to successfully move

141
00:04:38,070 --> 00:04:39,480
around the globe pretty quickly

142
00:04:39,480 --> 00:04:40,890
because so many systems were missing

143
00:04:40,890 --> 00:04:43,500
a critical operating system patch for Windows 7,

144
00:04:43,500 --> 00:04:45,780
Windows 8, and Windows 10-based systems,

145
00:04:45,780 --> 00:04:49,410
which is known as MS17-010.

146
00:04:49,410 --> 00:04:51,690
If the system simply had this patch installed,

147
00:04:51,690 --> 00:04:53,550
it would've prevented the EternalBlue exploit

148
00:04:53,550 --> 00:04:55,680
from being successfully run against those systems

149
00:04:55,680 --> 00:04:58,050
as part of a future ransomware attack.

150
00:04:58,050 --> 00:05:00,420
Third, we need to provide security awareness training

151
00:05:00,420 --> 00:05:01,770
to our end users.

152
00:05:01,770 --> 00:05:04,260
Now, many of the most successful ransomware attacks

153
00:05:04,260 --> 00:05:06,480
were begun by an end user clicking on a link

154
00:05:06,480 --> 00:05:08,250
in a simple phishing email.

155
00:05:08,250 --> 00:05:11,670
Your users must always be skeptical of unsolicited emails,

156
00:05:11,670 --> 00:05:12,570
especially with those

157
00:05:12,570 --> 00:05:14,310
that have attachments or links in them,

158
00:05:14,310 --> 00:05:16,560
because they're often used as a common attack vector

159
00:05:16,560 --> 00:05:19,890
by malware, viruses, trojans, and ransomware.

160
00:05:19,890 --> 00:05:22,110
Bottom line, if something looks suspicious,

161
00:05:22,110 --> 00:05:24,780
your end users simply shouldn't click on it.

162
00:05:24,780 --> 00:05:27,030
Fourth, your organization should also implement

163
00:05:27,030 --> 00:05:28,860
multi-factor authentication.

164
00:05:28,860 --> 00:05:31,590
Now, multi-factor authentication, known as MFA,

165
00:05:31,590 --> 00:05:33,720
can be enabled on your authentication systems

166
00:05:33,720 --> 00:05:35,340
to provide an extra layer of security,

167
00:05:35,340 --> 00:05:37,410
which in turn makes it more difficult for attackers

168
00:05:37,410 --> 00:05:38,820
to breach your user accounts,

169
00:05:38,820 --> 00:05:40,980
install ransomware on your systems.

170
00:05:40,980 --> 00:05:42,810
So what do you do if you find yourself

171
00:05:42,810 --> 00:05:44,760
the victim of a ransomware attack?

172
00:05:44,760 --> 00:05:47,430
Well, first, you should never pay the ransom.

173
00:05:47,430 --> 00:05:48,750
While it may seem like the quickest way

174
00:05:48,750 --> 00:05:50,010
to get out of the situation,

175
00:05:50,010 --> 00:05:52,290
paying the ransom does not actually guarantee

176
00:05:52,290 --> 00:05:53,970
that you'll ever get your data back.

177
00:05:53,970 --> 00:05:56,430
Plus, paying the ransom does reward the attackers

178
00:05:56,430 --> 00:05:57,750
and their criminal behavior.

179
00:05:57,750 --> 00:05:58,950
It funds future attacks.

180
00:05:58,950 --> 00:06:00,270
And it can get you added

181
00:06:00,270 --> 00:06:02,220
as a person who pays up when they're attacked,

182
00:06:02,220 --> 00:06:03,900
which then encourages other attackers

183
00:06:03,900 --> 00:06:06,300
to try and compromise your systems a second time

184
00:06:06,300 --> 00:06:08,820
in order to get a second payment from you.

185
00:06:08,820 --> 00:06:11,940
Second, if you suspect ransomware has infected your machine,

186
00:06:11,940 --> 00:06:14,220
you should immediately disconnect it from the network.

187
00:06:14,220 --> 00:06:16,410
By isolating the affected machine from your network,

188
00:06:16,410 --> 00:06:17,820
you can prevent the spread of ransomware

189
00:06:17,820 --> 00:06:20,430
across the rest of your workstations and servers.

190
00:06:20,430 --> 00:06:22,710
Third, you should notify the authorities.

191
00:06:22,710 --> 00:06:26,010
Remember, a ransomware attack is considered a criminal event

192
00:06:26,010 --> 00:06:28,200
and they should be reported like the crime they are.

193
00:06:28,200 --> 00:06:30,120
Now reporting of ransomware attack can help authorities

194
00:06:30,120 --> 00:06:33,090
track down and apprehend the attackers too, which is great.

195
00:06:33,090 --> 00:06:34,980
But note, you should not make the decision

196
00:06:34,980 --> 00:06:37,410
to report the attack to the authorities on your own.

197
00:06:37,410 --> 00:06:39,270
If this happened inside your organization,

198
00:06:39,270 --> 00:06:40,103
you need to consult

199
00:06:40,103 --> 00:06:42,450
your organizational instant response processes

200
00:06:42,450 --> 00:06:44,010
because some organizations prefer

201
00:06:44,010 --> 00:06:46,260
to handle ransomware incidents internally

202
00:06:46,260 --> 00:06:48,840
without involving external law enforcement.

203
00:06:48,840 --> 00:06:51,120
And fourth, you should restore your data and systems

204
00:06:51,120 --> 00:06:52,590
from known good backups.

205
00:06:52,590 --> 00:06:54,417
If you're following the cybersecurity best practices

206
00:06:54,417 --> 00:06:56,430
and have been backing up your data to an offsite

207
00:06:56,430 --> 00:06:57,810
or offline environment,

208
00:06:57,810 --> 00:06:59,370
you're going to find that you can quickly

209
00:06:59,370 --> 00:07:01,740
and relatively easily restore your business operations

210
00:07:01,740 --> 00:07:03,180
using those backups.

211
00:07:03,180 --> 00:07:04,620
But you first need to ensure

212
00:07:04,620 --> 00:07:07,140
that the ransomware is completely removed from your systems

213
00:07:07,140 --> 00:07:09,390
before you restore your critical and sensitive data

214
00:07:09,390 --> 00:07:10,680
back onto those systems.

215
00:07:10,680 --> 00:07:12,960
Otherwise, they could get encrypted again.

216
00:07:12,960 --> 00:07:15,930
So remember, ransomware is a type of malicious software

217
00:07:15,930 --> 00:07:18,180
that's designed to block access to a computer system

218
00:07:18,180 --> 00:07:19,020
or its data

219
00:07:19,020 --> 00:07:22,140
by encrypting it until the ransom is paid to the attacker.

220
00:07:22,140 --> 00:07:24,120
You can prevent the worst effects of ransomware

221
00:07:24,120 --> 00:07:25,650
by conducting regular backups,

222
00:07:25,650 --> 00:07:27,300
installing regular software updates,

223
00:07:27,300 --> 00:07:29,670
providing security awareness training to your end users,

224
00:07:29,670 --> 00:07:31,890
and implementing multi-factor authentication

225
00:07:31,890 --> 00:07:33,420
in your IT systems.

226
00:07:33,420 --> 00:07:35,580
If you do fall victim of a ransomware attack,

227
00:07:35,580 --> 00:07:37,230
remember to never pay the ransom,

228
00:07:37,230 --> 00:07:39,330
disconnect the infected system from the network,

229
00:07:39,330 --> 00:07:41,280
notify the authorities if that's in alignment

230
00:07:41,280 --> 00:07:43,380
with your organization's instant response policies,

231
00:07:43,380 --> 00:07:45,510
and restore your data from known good backups

232
00:07:45,510 --> 00:07:47,640
to get your business operations restored back to normal

233
00:07:47,640 --> 00:07:48,963
as quickly as possible.