In this lesson,
we're going to discuss the world of ransomware.
Now, ransomware is the digital equivalent of kidnapping.
But instead of focusing on people,
we are focused on digital data and information assets.
Let's imagine for a moment
that somebody came over to your house today.
They grabbed your child when you weren't home,
and then they sent you a letter demanding $1 million
for your child's safe return.
This type of kidnapping is usually pretty successful
because the victim's family will usually pay up
to ensure the safe return of their child.
Now, with this in mind,
let's go back to the digital world
and talk about ransomware,
because ransomware is a type of malicious software
that's designed to block access to a computer system
or its data by encrypting it until a ransom is paid
over to the attacker.
Now, generally, ransomware will display a message
to the victim that demands payment
in exchange for a decryption key
which can decrypt your data files.
Some ransom amounts can be fairly low
like a few hundred dollars
if the attacker determines they have encrypted the files
of an individual user system.
But we've also seen demands in the multi-millions of dollars
for large organizations
that have become the victim of a ransomware attack.
To really understand the scale
and scope of this type of ransomware problem,
let's just take a look
at a relatively recent, high-profile incident,
known as a Colonial Pipeline attack of 2021.
Colonial Pipeline is a major US fuel company
that fell victim to a ransomware attack
that forced them to shut down their pipeline.
Now, that doesn't sound so bad on the surface.
But the problem here is
that the Colonial Pipeline actually carries
nearly half of the United States' fuel supply
on the East Coast.
Now, due to this ransomware attack
that took over their systems,
the company was unable to use their pipeline
for five straight days.
This shutdown caused massive disruptions,
which led to fuel shortages, panic buying,
and a pretty large spike in gas prices.
The attackers, known as the DarkSide,
demanded and then received a ransom
of approximately $4.4 million in Bitcoin
to provide the decryption key for this attack.
While the payment facilitated
the recovery of some of the encrypted data,
the attackers repercussions really fell
across industries and households for weeks.
Luckily, during the Colonial Pipeline ransom attack,
nobody was seriously injured.
But that isn't always the case.
One of the most tragic real-world examples
of a ransomware attack actually occurred
at the University Hospital in Dusseldorf, Germany,
back in September of 2020.
Back then, the University Hospital, Dusseldorf,
suffered a ransomware attack which crippled their systems.
Because of the attack,
the hospital's computer systems were disrupted,
and they began to divert patients
who required emergency treatment to other hospitals
while the cybersecurity team was working
to regain access to their systems and to restore their data.
Now, among those patients who were being diverted was
a woman who is suffering from a life-threatening condition.
Due to the delay caused by rerouting her ambulance
to another hospital because of that ransomware attack,
this woman actually died
making this the first death
directly linked to a ransomware attack in a hospital.
Now, German authorities launched an investigation.
And if the attackers were caught,
they could have faced charges of manslaughter
in addition to cyber crime charges
because somebody died as a result of the attack.
The attackers claimed they did not intend
to target the University Hospital system,
but instead they were targeting
the Heinrich Heine University.
But they attacked the hospital by mistake.
When they learned about the mistake
and the severe consequences of their actions,
they provide the decryption key to the hospital
without demanding a future ransom.
This ransomware attack really does underscore
just how vulnerable critical infrastructure can be
to a ransomware attack
and the cascading consequences
that these ransomware attacks can have
on our society at large.
So now that we understand the gravity of ransomware,
how can we protect ourselves
and our organizations against it?
Personally, I recommend following
four security best practices
to prevent becoming the victim of a ransomware attack.
These are conducting regular backups,
installing regular software updates,
providing security awareness training to your end users,
and implementing multi-factor authentication
for your systems.
First, you should always conduct regular backups.
One of the most effective ways to mitigate
against the impact of a ransomware attack is
to regularly back up
all of your important data, files, and systems.
These backups should be stored both on physical devices
in your own on-premise data center,
as well as the second backup
conducted using cloud-based storage solutions
to ensure that they're not connected
to the main system that you're trying to protect.
For example, if you only have one external hard drive
connected to your system that serves as your backup,
this device will be encrypted by the ransomware
if your system is attacked as well.
But by having cloud-based storage
or an offsite disconnected storage solution available,
you're going to have a full copy of your data
if you need to restore those from backup
because of a ransomware attack.
Second, you should install software updates regularly.
By regularly updating all of your software,
especially your operating system and antivirus programs,
you can prevent an attacker
from being able to exploit vulnerabilities
and outdated software and operating systems.
For example, the WannaCry ransomware attacks
of 2017 were able to successfully move
around the globe pretty quickly
because so many systems were missing
a critical operating system patch for Windows 7,
Windows 8, and Windows 10-based systems,
which is known as MS17-010.
If the system simply had this patch installed,
it would've prevented the EternalBlue exploit
from being successfully run against those systems
as part of a future ransomware attack.
Third, we need to provide security awareness training
to our end users.
Now, many of the most successful ransomware attacks
were begun by an end user clicking on a link
in a simple phishing email.
Your users must always be skeptical of unsolicited emails,
especially with those
that have attachments or links in them,
because they're often used as a common attack vector
by malware, viruses, trojans, and ransomware.
Bottom line, if something looks suspicious,
your end users simply shouldn't click on it.
Fourth, your organization should also implement
multi-factor authentication.
Now, multi-factor authentication, known as MFA,
can be enabled on your authentication systems
to provide an extra layer of security,
which in turn makes it more difficult for attackers
to breach your user accounts,
install ransomware on your systems.
So what do you do if you find yourself
the victim of a ransomware attack?
Well, first, you should never pay the ransom.
While it may seem like the quickest way
to get out of the situation,
paying the ransom does not actually guarantee
that you'll ever get your data back.
Plus, paying the ransom does reward the attackers
and their criminal behavior.
It funds future attacks.
And it can get you added
as a person who pays up when they're attacked,
which then encourages other attackers
to try and compromise your systems a second time
in order to get a second payment from you.
Second, if you suspect ransomware has infected your machine,
you should immediately disconnect it from the network.
By isolating the affected machine from your network,
you can prevent the spread of ransomware
across the rest of your workstations and servers.
Third, you should notify the authorities.
Remember, a ransomware attack is considered a criminal event
and they should be reported like the crime they are.
Now reporting of ransomware attack can help authorities
track down and apprehend the attackers too, which is great.
But note, you should not make the decision
to report the attack to the authorities on your own.
If this happened inside your organization,
you need to consult
your organizational instant response processes
because some organizations prefer
to handle ransomware incidents internally
without involving external law enforcement.
And fourth, you should restore your data and systems
from known good backups.
If you're following the cybersecurity best practices
and have been backing up your data to an offsite
or offline environment,
you're going to find that you can quickly
and relatively easily restore your business operations
using those backups.
But you first need to ensure
that the ransomware is completely removed from your systems
before you restore your critical and sensitive data
back onto those systems.
Otherwise, they could get encrypted again.
So remember, ransomware is a type of malicious software
that's designed to block access to a computer system
or its data
by encrypting it until the ransom is paid to the attacker.
You can prevent the worst effects of ransomware
by conducting regular backups,
installing regular software updates,
providing security awareness training to your end users,
and implementing multi-factor authentication
in your IT systems.
If you do fall victim of a ransomware attack,
remember to never pay the ransom,
disconnect the infected system from the network,
notify the authorities if that's in alignment
with your organization's instant response policies,
and restore your data from known good backups
to get your business operations restored back to normal
as quickly as possible.