Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Blog de Tenable

Suscribir

Ransomware Preparedness: Why Organizations Should Plan for Ransomware Attacks Like Disasters

Ransomware Preparedness: Why Organizations Should Plan for Ransomware Like Disasters
Ransomware Preparedness: Why Organizations Should Plan for Ransomware Like Disasters

As ransomware has cemented itself as one of the biggest cybersecurity threats to companies around the globe, it has become increasingly important that organizations treat ransomware attacks like they would a natural disaster and establish a robust preparedness plan.

Antecedentes

In 2020, Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency (CISA) called ransomware the “most visible, disruptive cyber threat” as he saw it then. Nearly two years later, Lindy Cameron, the chief executive of the National Cyber Security Centre (NCSC) in the United Kingdom calls ransomware the “biggest global cyber threat” today.

Over the last four years, CISA, NCSC and other global agencies including the FBI and the Australian Cyber Security Centre (ACSC) have issued multiple warnings about the risk of ransomware, yet it remains the most dominant threat facing organizations today.

In a recent survey of chief information security officers, nearly 70% expect to be impacted by a ransomware attack within the next year, with nearly a quarter of companies saying they were impacted by ransomware attacks on more than one occasion.

Despite the prevalence of these attacks, many organizations are not adequately prepared to respond to ransomware incidents. Organizations should ready themselves for ransomware like they do for any other emergency.

The Federal Emergency Management Agency (FEMA) in the United States has outlined the four phases of emergency management for disasters and emergencies as: mitigation, preparedness, response and recovery. This same framework can be applied to ransomware attacks.

Mitigation is the natural first step in defense

For any organization looking to defend against ransomware attacks, their primary focus should be placed on mitigation. You are likely familiar with the mitigation steps you and your organization have taken to prepare for the sorts of disasters covered by FEMA’s guidance: evacuation maps around the office in the case of a fire, maintaining insurance, battening down the hatches.

When it comes to ransomware, we know many of the tactics and techniques used by the key members in the ransomware ecosystem, from spearphishing and targeting Remote Desktop Protocol (RDP) to exploiting unpatched and zero-day vulnerabilities. Mitigation relies on identifying and securing these known attack paths, whether it’s through the use of antivirus or anti-malware and email gateways, user awareness training and vulnerability management solutions. However, even with this wealth of knowledge, organizations continue to fall victim to ransomware attacks.

Organizations should prioritize preparedness

Regardless of the emergency for which you are preparing, having a plan is critical. Most organizations likely already have incident response plans for events like natural disasters; mature organizations likely also have technology or cybersecurity focused incident response plans. As FEMA notes in one of its sample emergency management documents, it’s not just about writing the plan, but about drilling the plan and refining it.

Preparedness is an often overlooked element in the emergency management of ransomware attacks. It is not just about focusing on the various mitigation measures as a form of preparation, it is also imperative for organizations to prepare by conducting simulated attacks against their networks to test incident response plans with various stakeholders. CISA has published a variety of CISA Tabletop Exercise Packages (CTEPs) that can be the foundation for your organization’s preparedness. Walking through a simulated ransomware attack enables an organization to identify gaps in their incident response plans. Additionally, being prepared makes the various stakeholders within your organization feel confident that in the event of a real ransomware attack, the response will be measured instead of chaotic.

Response and recovery is sometimes chaotic

Response is when you put your tested plans into practice and see whether your mitigations meet their intended purpose. According to FEMA, “business and other functions do not operate normally” during these phases. The focus is on understanding and limiting the disaster’s scope of impact, shaping public perception of the incident and beginning the process of returning to “business as usual.”

How an organization responds to a ransomware attack has become more important over the last few years, as ransomware groups not only encrypt files within a company’s network, but also exfiltrate and threaten to publish these files on leak websites hosted on the dark web. This tactic creates a sense of urgency, as ransomware groups provide little time for negotiations. So while an organization is tasked with trying to recover from an attack and restore network operations, they also face the added pressure of reputational harm from the leak of confidential information.

Because of the public nature of leak websites and the ardent tracking by reporters, ransomware response is often done in the public eye. This means that response operations are not limited to security and IT teams. Teams including customer support, legal, public relations and investor relations may all end up involved in the response. Those groups should also be part of preparedness efforts.

A challenge when responding to a ransomware attack is that organizations must negotiate with individuals or groups that weren’t responsible for attacking them. In the ransomware ecosystem, third parties such as ransomware affiliates and initial access brokers are the ones gaining a foothold within an organization before selling that access or partnering with ransomware groups directly. This distributed involvement can complicate negotiations and the investigations necessary for recovery.

Several moving parts are involved in the response and recovery process, but organizations don’t need to operate from a reactive position. They can be proactive through preparedness.

A global preparedness initiative is needed

In the United States, the Department of Homeland Security’s ready.gov resource provides low cost and free preparedness guides. We believe a similar resource should be created for ransomware preparedness and made available for organizations around the world, since ransomware is a global threat, as the NCSC’s Cameron has pointed out.

Steps you can take right now to be more prepared

  • Review your incident response plans (or start developing one) and confirm it’s sufficient to address a ransomware attack.
  • Conduct tabletop exercises with various stakeholders within your organization at least once a year if not more often.
  • Cut off known attack vectors by patching known, exploited vulnerabilities and addressing Active Directory misconfigurations. Tenable Research has produced scan templates and dashboards for Tenable.io, Tenable.sc and Nessus that can help identify known vulnerabilities used by ransomware affiliates and IABs.
  • Establish visibility for your organization’s full attack surface and how attackers may seek to breach your defenses.

Obtenga más información

Únase al Equipo de respuesta de seguridad de Tenable en Tenable Community.

Obtenga más información sobre Tenable, la primera plataforma de Cyber Exposure para el control integral de la superficie de ataque moderna.

Obtenga una prueba gratuita de 30 días de Tenable.io Vulnerability Management.

Artículos relacionados

¿Es usted vulnerable a los últimos exploits?

Ingrese su correo electrónico para recibir las últimas alertas de Cyber Exposure en su bandeja de entrada.

tenable.io

Disfrute el acceso completo a una plataforma moderna para la gestión de vulnerabilidades en la nube, que le permite ver y rastrear todos sus activos con una precisión inigualable.

La prueba de Tenable.io Vulnerability Management incluye también Tenable Lumin, Tenable.io Web Application Scanning y seguridad en la nube de Tenable.cs.

tenable.io COMPRAR

Disfrute el acceso completo a una plataforma moderna para la gestión de vulnerabilidades en la nube, que le permite ver y rastrear todos sus activos con una precisión inigualable. Compre una suscripción anual hoy mismo.

65 activos

Seleccione su tipo de suscripción:

Comprar ahora

Pruebe Nessus Professional gratis

GRATIS DURANTE 7 DÍAS

Nessus® es el analizador de vulnerabilidades más completo en el mercado actual. Nessus Professional le ayudará a automatizar el proceso de análisis de vulnerabilidades, le ahorrará tiempo en sus ciclos de cumplimiento y permitirá la participación su equipo de TI.

Compre Nessus Professional

Nessus® es el analizador de vulnerabilidades más completo en el mercado actual. Nessus Professional le ayudará a automatizar el proceso de análisis de vulnerabilidades, le ahorrará tiempo en sus ciclos de cumplimiento y permitirá la participación su equipo de TI.

Compre una licencia multi anual y ahorre. Agregue Soporte Avanzado para acceder a soporte por teléfono, chat y a través de la Comunidad las 24 horas del día, los 365 días del año.

Seleccione su licencia

Compre una licencia multi anual y ahorre.

Añadir soporte y capacitación

Tenable.io

Disfrute el acceso completo a una plataforma moderna para la gestión de vulnerabilidades en la nube, que le permite ver y rastrear todos sus activos con una precisión inigualable.

La prueba de Tenable.io Vulnerability Management incluye también Tenable Lumin, Tenable.io Web Application Scanning y seguridad en la nube de Tenable.cs.

Tenable.io COMPRE

Disfrute el acceso completo a una plataforma moderna para la gestión de vulnerabilidades en la nube, que le permite ver y rastrear todos sus activos con una precisión inigualable. Compre una suscripción anual hoy mismo.

65 activos

Seleccione su tipo de suscripción:

Comprar ahora

Pruebe Tenable.io Web Application Scanning

Disfrute el acceso completo a nuestra oferta de productos más recientes para el escaneo de aplicaciones web diseñados para aplicaciones modernas como parte de la plataforma Tenable.io. Escanee de manera segura todo su portafolio en línea para detectar vulnerabilidades con alto grado de exactitud sin el esfuerzo manual intensivo ni la interrupción de aplicaciones web críticas. Registrarse ahora.

La prueba de Tenable Web Application Scanning incluye también Tenable.io Vulnerability Management, Tenable Lumin y seguridad en la nube de Tenable.cs.

Adquiera Tenable.io Web Application Scanning

Disfrute el acceso completo a una plataforma moderna para la gestión de vulnerabilidades en la nube, que le permite ver y rastrear todos sus activos con una precisión inigualable. Compre una suscripción anual hoy mismo.

5 FQDN

USD 3578

Comprar ahora

Pruebe Tenable.io Container Security

Disfrute del acceso sin límites a la única oferta de productos para la seguridad de contenedores integrada en una plataforma de gestión de vulnerabilidades. Supervisa imágenes de contenedores para detectar vulnerabilidades, malware e infracciones a las políticas. Integración con sistemas de implementación continua (CI/CD) para respaldar las prácticas de las operaciones de desarrollo, fortalecer la seguridad y respaldar el cumplimiento con las políticas empresariales.

Adquiera Tenable.io Container Security

Tenable.io Container Security permite de forma fácil y segura procesos de DevOps al ofrecer visibilidad sobre la seguridad de las imágenes de contenedores, incluyendo vulnerabilidades, malware e infracciones a políticas, mediante la integración con el proceso de desarrollo.

Probar Tenable Lumin

Con Tenable Lumin, visualice y explore su Cyber Exposure, dé seguimiento a la reducción del riesgo con el tiempo y compárela con la de sus competidores.

La prueba de Tenable Lumin incluye también Tenable.io Vulnerability Management, Tenable.io Web Application Scanning y seguridad en la nube de Tenable.cs.

Comprar ahora Tenable Lumin

Póngase en contacto con un representante de ventas para averiguar cómo Lumin puede ayudarle a obtener información de toda su organización y gestionar el riesgo cibernético.

Pruebe Tenable.cs

Disfrute de acceso total para detectar y reparar los errores de configuración de la infraestructura en la nube y ver vulnerabilidades en tiempo de ejecución. Regístrese ahora para su prueba gratuita.

La prueba de seguridad en la nube de Tenable.cs incluye también Tenable.io Vulnerability Management, Tenable Lumin y Tenable.io Web Application Scanning.

Póngase en contacto con un representante de ventas para comprar Tenable.cs

Póngase en contacto con un representante de ventas para obtener más información acerca de Tenable.cs Cloud Security. Entérese de lo fácil que es incorporar sus cuentas de la nube y obtener visibilidad hacia configuraciones incorrectas y vulnerabilidades en la nube en cuestión de minutos.

Probar Nessus Expert gratuitamente

GRATIS POR 7 DÍAS

Diseñado para la superficie de ataque moderna, Nessus Expert le permite ver más y proteger a su organización contra las vulnerabilidades, desde TI hasta la nube.

¿Ya tiene Nessus Professional?
Actualice a Nessus Expert gratuitamente por 7 días.

Comprar Nessus Expert

Diseñado para la superficie de ataque moderna, Nessus Expert le permite ver más y proteger a su organización contra las vulnerabilidades, desde TI hasta la nube.

Seleccione su licencia

Los precios promocionales terminan el 30 de septiembre.
Compre una licencia plurianual y ahorre.

Añadir soporte y capacitación