Archives for June 2018

When it comes to falling victim to a ransomware attack, it’s not a case of ‘if’ but ‘when’.

By Matt Body – IT ProPortal

Ransomware has been growing in awareness for years, and its potential harm and disruption has been widely discussed across the board. However, last year, awareness peaked as ransomware caused havoc for organisations, as threats like WannaCry and NotPetya found them to be defenceless and vulnerable. In spite of attacks happening again and again, many organisations are still not able to effectively defend against them.

Recent research from Sophos, which looked at The State of Endpoint Security Today, revealed the extent to which organisation are unprepared for ransomware attacks. Findings revealed that the defence readiness and end-point security from organisations needs a lot of work – over half of organisations (54%) were hit by ransomware in the past year, and the average cost of an attack was $133,000.

When it comes to IT security, the usual consensus is that once an organisation encounters a specific threat, they learn from it, shore up their defences, and are then better prepared for the next attack. However, the research revealed that with ransomware, this approach doesn’t work as respondents said they were hit by ransomware multiple times, and expect that they’ll fall victim to it again in the future.

With ransomware, it is clear that no organisation can afford to be complacent. Cybercriminals are deploying a variety of different attack methods until they’re successful, whether using a mix of ransomware in a single campaign or taking advantage of a remote access opportunity, then infecting the server and disabling security software. With attacks only becoming more frequent and complex, it is time for organisations to prepare and protect, and avoid falling victim to the next attack.

Don’t be fooled – Ransomware needs to be treated differently

After a ransomware attack, we usually find ourselves pointing the finger at the breached organisation –  were there defenses in place? Were systems up to date? Were patches in place? However, once again this is not always the case when it comes to ransomware, as over three quarters of respondents said that they were running up-to-date software when ransomware hit.

Therefore, it is clear that traditional endpoint protection alone cannot and does not stop the latest in ransomware attacks.

Given the ingenuity, frequency and financial impact of attacks, all businesses should re-evaluate their security to include predictive security technology that has the capabilities needed to combat ransomware and other costly cyber threats.

Knowledge is key

Seeing as not all anti-ransomware technology offers equally effective protection against attacks, many organisations may find themselves investing in technologies which offer little protection when the attacks occur. And it seems the knowledge gap widens from here, as the research revealed that less than one in three respondents were able to correctly define what anti-ransomware and anti-exploit technologies do.

With this many professionals having this level of understanding, a significant number of organisations may believe that they are adequately protected against the ransomware threat, but are not. Therefore, it’s important that organisations do their research and ensure that they have the right level of protection in place.

Deep learning

The key to being protected against ransomware can be found by changing from a traditional security methodology which can only stop previously seen before threats to a predictive one.

Over the years, traditional approaches to security (i.e. anti-virus that use signatures) have focused on improving the time to stopping a threat by increasing the update increments.  Traditional security methods are very accurate and can spot and block seen before malicious software within as little as an hour after the first report.  Since we’re now seeing as much as 400,000 different malicious files a day it’s very difficult to keep up with the ever changing threat landscape using this traditional technology.  Machine learning now plays a crucial part in tackling this issue by predicting what a malicious file looks like.

Machine learning ‘learns’ using mathematical models instead of being specifically programmed to address a particular problem. Deep learning is the latest evolution of machine learning.  In the context of stopping malware, a deep learning engine is trained on hundreds of millions of previously seen before malicious and non-malicious files.  Using the features of these files, it then looks for correlations and similarities in the malicious vs non-malicious files.  By doing this grouping of similarities the deep learning engine is then able to accurately sort files into two buckets, malicious and not malicious with the anti-virus left to quarantine accordingly.  By using deep learning, you’re not just stopping a previously seen bad file, you’re stopping ones which have never been seen before as well.

Although 60 percent of respondents admitted their endpoint defenses are not enough to block the huge ransomware attacks we saw last year, only 25 percent have predictive threat technologies such as machine learning or deep learning, which leaves 75 percent vulnerable to repeated ransomware attacks.

Given the speed at which cyber threats have evolved it is not surprising that many IT departments are unable to stay ahead of the next-generation technology required for security. Yet this knowledge gap could be placing operations at risk. Organisations need effective anti-ransomware, anti-exploit, and deep learning technology to stay secure.

You’re not alone

To many organisations, the urgency and complexity of protecting against ransomware and cyber attacks in general may seem daunting. In fact, 87 percent of respondents said that the malware threat had grown more complex in the last year. In order to effectively stop ransomware in its tracks, traditional endpoint security isn’t enough.

Organisations need the strongest defense against these persistent threats, and so need to explore, learn, and adopt anti-exploit and anti-ransomware technologies in order to be fully prepared against future attacks – it’s not a case of ‘if’, but ‘when’.