Jump to content

Best Ransomware prevention.


Chauke

Recommended Posts

Hello there, 

i would love to know what kind of prevention you use against Ransomware.
Do you have a emergency plan if it happens ?
Current prevention Methode:

  1. Strict executable Policys for executable's from the Web
  2. Multiple Backup Systems one with cold storage.
  3. Strict e-mail Filter 
  4. Training for other employee. (Let them regulary know what to look for)
  5. Preparations for the emergency case.
  • Like 2
Link to comment
Share on other sites

Here's a good list of stuff that helps greatly:

  • Hardened gold images for all end user devices, including:
    • Strict firewall rules for ingress traffic
    • Application whitelisting
    • Removal of administrative rights from users
    • Endpoint Detection and Response (eg Crowdstrike or similar)
    • Prevention of Domain Admins / Enterprise Admins from logging in
    • Web access via secure proxy only
    • PATCHING
    • LAPS  / no static local admin passwords
    • Disable default Administrator accounts, create secondary non-standard named accounts
  • Integrated identity with AAD or similar
  • Strong password policy (less rotation, greater length), with MFA everywhere
  • Network segregation to prevent lateral movement (micro-segmentation is looking like a good option right now)
  • Backups to segregated systems for recovery, or Cloud based backup (eg OneDrive) where you can simply download older versions of files, pre-encryption
  • Regular patching of applications
  • Prevent compromise of your network via web applications
    • Segregate application hosting from corporate networks
    • Zero Trust service to expose your apps to users (eg AAD Enterprise Apps / App Proxy, Cloudflare Zero Trust, Google Cloud IAP)
    • Web application firewalls to detect and prevent common attacks
  • Email filtering, with sandboxed browsers for opening links in emails (eg, Proofpoint Browser Isolation)
  • Regular exercises for recovery
  • Employee awareness training
  • Security Operations 24/7, to monitor and respond to alerts and reports from users
  • Red Team exercises to level up your defense coverage and capability
  • Don't let IT use domain admin / enterprise admin credentials on their regular computers - use separate admin workstations for admin work, do not allow email or IM on these systems
  • Honeypot systems in your networks to detect malicious / unwanted behavior
  • Honeypot accounts in your directory to detect potential abuse

I could go on 😛 but I won't 😄

  • Like 6
  • Thanks 2
Link to comment
Share on other sites

Hey there,

you have good points.

Additionally:

1. Block Macros in MS Office

2. Block/deactivate Windows-Scripting-Host

3. Monitor Account creation, especially new service and admin accounts.

4. Whitelist for allowed data types from the Web and in E-Mails

5. Monitor admin privilege usage

6. Network segmentation with strict rules at the perimeters

 

For emergency plan (your point 5):

In general we set up a communication plan for disaster recovery. Not specific to Ransomware.

This communication plan consists of the persons who need to be informed in the company but also external organizations (Police, Insurance, Data Protection.Incident Response Consultant Company)

Additionally we have defined that a core team for handling the disaster will be formed, that than controls the Incident Response.

But, like I said, not specific too Ranswomare, more in general.

 

 

  • Like 3
Link to comment
Share on other sites

35 minutes ago, kalinko said:

1. Block Macros in MS Office

2. Block/deactivate Windows-Scripting-Host

I was pretty sure I missed something obvious, and here it is 😉

Even blocking things like powershell use on regular desktops is a big win 🙂

  • Like 1
Link to comment
Share on other sites

Ransomware prevention pretty much just encapsulates EDR as a whole. A lot of ransomware uses RATs as an initial access vector, so preventing malware/RATs, credential theft, phishing, etc, will greatly help your ability to prevent ransomware. 

  • Like 1
  • Thanks 1
Link to comment
Share on other sites

@clarkee provided a very solid list for you.  Exec support is critical I found and the point I made is that ransomware is not always distributed just via email, while it's the most common method it's not the sole method.  My execs just thought email was the only vector.  Network compromise is proving more popular, as dark markets have creds for sale to access networks.  Lots of companies don't feel the need to monitor that space, but to us we use a third party to monitor as best we can (not perfect).  Think I read somewhere a 10% rise in network compromise, perhaps someone has more info then I on that.

re point 5, this is where a lot of us will differ.  We've got an emergency plan specific to ransomware, think Harm Reduction type plans Healthcare may have.  For us it will ultimately depend on entry point but we've mapped that out and incorporated it into our response & recovery plans along with calculating acceptable loss.

  • Like 2
Link to comment
Share on other sites

There's nothing really specific to ransomware.  It's all the same "least privilege"/"basics" everyone skips because they're tedious and time consuming.

Realistically, the "quick wins" (such as they are) are to limit permissions (reduce the level people normally run under, disallow local accounts from network access, etc.), minimize attack surface (disable macros, nerf uncommon executable types by defaulting them to open in notepad, etc.), limit reach (segmentation), patch, and back up.

That last one, the backups, those are both the most important and usually the hardest sell since they involve spending money (not just your time).  In the grand scheme of things, $50k for a couple backup servers isn't that much (scale to size of business); but on the other hand, it's still $50k for "just in case".  One of the "tricks" to getting a backup program rolling (if you don't have a "do it or shut down" regulatory requirement to point to; if you do, job done) is to emphasize the benefit to other parts of the company.  Like, if all your data is centralized and backed up, most of your endpoints become interchangeable and it's real quick to just swap one out... now that employee is working again rather than waiting for IT ops to finish troubleshooting... and IT ops can be more efficient in their work ("reimage it" is an efficient solution to most non-recurring endpoint problems).  Another point to make is that ransomware isn't the only threat backups help mitigate; functionally the only difference between a drive controller fritzing out and corrupting a bunch of drives and those drives getting encrypted by ransomware is that you can't bargain with the drive controller.

  • Like 1
  • Thanks 1
Link to comment
Share on other sites

Most of the advice I find on the web is for medium/big corporations running windows desktops and microsoft internal IT software. Does anyone has tips for small companies running mac os endpoints ? I know of some ransomware campaigns targetting macs but it seems like a niche issue at the moment, or am i deluded ?

Link to comment
Share on other sites

On 11/20/2022 at 11:53 AM, Spud said:

Most of the advice I find on the web is for medium/big corporations running windows desktops and microsoft internal IT software. Does anyone has tips for small companies running mac os endpoints ? I know of some ransomware campaigns targetting macs but it seems like a niche issue at the moment, or am i deluded ?

No you are right about it. Mac is not as targeted when it comes to company's but they are a targeted when is comes to individual consumers.
Your Company could get hit with ransomware that was made for single individuals. It does not matter how big your company is.
If there is money than there will be thief's. But for the most part the tips posted here are valid for any OS.

  • Thanks 1
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...