Cyber Incident · cybersecurity · Distaster Recovery · Hacking · Malware · Ransomeware

Trick or Treat – Ransomware is a Trick disguised as a Treat

This time of year, causes me to think about cyber lessons learned, malware related questions from customers and colleagues and all the ghoulish activities we have witnessed in 2017. We have seen obvious phishing mails that are clearly spoofed email addresses or URL’s and have provocative messages to drive users to click. These provoke the users to click the message, open an attachment or a click infected URL that cause the execution of the malware. Another common way to be become infected is through compromised websites that can trigger the installation of an unintentional program download.  These are “Tricks” used to cause a user to change their normal behaviors. As we have more and more awareness of Phishing and Ransomware, our ability to be “Tricked” has been reduced, but not eliminated.

Ransomware has now become synonymous with Phishing. The two attack types are merged together into an embedded encryption attack. The statistics are showing that over 90% of all Phishing attacks now contain Ransomware encryption. The technique of the Phishing mails is changing in the business world to draw employees in and cause the attack to be successful. The emails that are now seen include a personalized message with a correct salutation that includes subjects of interest by job category. These are effective attacks and are gaining popularity. Sophistication of social engineering is improving in these types of attacks, while the skilled and resources required by an attacker execute them has diminished rapidly Any criminal can leverage ‘ransomware as a service’ on the dark web and inflict serious damage along with potentially huge financial gains.

Ransomware is also getting in to business systems through the vulnerability of operating systems and software. Targeted attacks are being delivered on outdated security software or system software. These types of attacks are broad and successful as we have seen over the past few months. The Malware enters the organization via targeted attacks of known vulnerabilities and they migrate through systems to infect the entire network and its connected devices.

Ransomware works in a very orchestrated manner. Once the ransomware program has been executed it starts communicating with its host to acquire an encryption key. This happens very quickly. Once the program has its key it encrypts the data on a system. The data is then unusable. Encrypted data can “typically” be recovered using the decryption key, but there are no guarantees given the source of the attack. Once the decryption key is delivered back to the program, the process can then be reversed.

The best preparation an organization can take is to follow common best practices. From updating end-point protection products, to implementing stringent data back-up procedures to patching and updating of software, best practices are not difficult in themselves, but require commitment and focus. These along with a cybersecurity process of Identify, Protect, Detect, Respond and Recover are extremely valuable for any business. Phishing/Ransomware Employee education and training continues to be a highly valuable process to do on a continual basis.

In addition to developing a Cybersecurity process and following a standardized framework, vulnerability scanning and monitoring network behavior are must have proactive countermeasures.

Lastly, nothing is guaranteed to keep your business safe, but, reducing your attack surface area will be worth the investment. The ability to know in real-time if an attack is in process and the knowledge to remediate or immediately take the suspect system off-line, can save you significant time, energy and money, the real “treats” of this Halloween season.

Read more of our Cytellix Cybersecurity blogs –

Cyber Incident · cybersecurity · Distaster Recovery · Hacking · Incident Response

Life was so simple, then Equifax, SEC, Whole Foods, Deloitte all hacked!

I have been getting calls and emails for the last few weeks about all the hacks and cyber events.  The central question is always, “what do I do to protect myself?”  It’s actually an impossible question to answer.  Why?  We do not have control of our own identities and assets.  They are managed and may even be owned by 3rd parties.  How can this be true?

The Credit Reporting Agencies (CRAs) own and or sell our credit identity information as a business.  Who owns your identity from a credit reporting perspective?  Perhaps it is not you.  But, let’s ask the question, how did I lose control of my credit identity to a 3rd party?  The information in your credit report comes directly from companies that have extended you credit in the past or from those with which you have open accounts. Credit card companies, banks, credit unions, retailers, and auto and mortgage lenders all report the details of your credit activity to the credit reporting agencies (CRAs).  The CRAs also receive information from debt collectors, and they purchase public records, such as bankruptcies, tax liens, and judgments, from public record providers.  Now, we know how our credit identity was assembled, but, what obligation do the CRAs have, to protect this information?

The Federal Trade Commission (FTC) has published a Safeguards Rule for protecting consumer information.  Institutions under FTC jurisdiction must have measures in place to keep customer information secure.  The CRAs fall under the FTC jurisdiction by definition. The safeguards are designed to be flexible for implementation by each organization vs prescriptive in nature.  The references for implementation processes to protect consumer information reference:

The recent testimony and prepared statement from Equifax point to a failure in process and implementation of a standard software patching process.  The other fact from the prepared testimony that was alarming was the lack of monitoring and process of a known vulnerability then the awareness (and lack of action), several months later, of a vulnerability through network traffic monitoring.  The vulnerability identified led the forensics team back to the original software that had an identified vulnerability that was not patched.  The contradiction and or lack of monitoring tools usage is a key message.  Monitoring of critical systems, identified vulnerabilities and changes of behavior of the network traffic are critical controls of a cybersecurity program.  In addition to training and process management, a cyber event can be prevented and/or observed in real-time based the network behaviors.

Back to the original question… “What do I do to protect myself?”  Here are some helpful tactics that are just good cyber hygiene.

    1. Change your passwords to be unique, do not repeat the same password
    2. Use complex passwords or a password generator
    3. Set up identity service monitoring through reputable sources
    4. Set up monitoring and alerts of banking accounts for money movement
    5. Option to shut down all credit application services
    6. Run device anti-virus/anti-malware products on all owned devices
    7. Make sure you have a firewall and the settings are not set to “default”
    8. Make sure all connected devices are protected and not set to default, segment if possible
    9. Learn about phishing and ransomware best practices
    10. Don’t surf unknown web sites
    11. If it looks suspicious or you are questioning its authenticity- investigate vs act