Recursos de Sophos para detener el Ransomware
El ransomware sigue evolucionando a cada instante y cada vez es más rápido, inteligente y costoso.
Teniendo en cuenta que un ataque de ransomware a gran escala cuesta, de media, la desorbitada cifra de 755 991 USD*, es fundamental saber a qué se enfrenta y cómo mantenerse protegido.
Forme a su empresa
Muchos ataques de ransomware comienzan con un correo electrónico malicioso. Los atacantes saben que, para entrar en su empresa, solo se necesita una persona que baje la guardia.
Nuestro kit de herramientas educativas antiransomware para directores de TI le ofrece recursos gratuitos para formar a sus usuarios sobre el ransomware, como una lista de comprobación para la empresa, pósteres de concienciación sobre seguridad y un vídeo informativo para los empleados.
How Does Ransomware Work?
Many ransomware attacks start with a malicious email as part of a targeted phishing scam. Cybercriminals know it only takes one individual at a company to let down their guard for them to gain access to your organization’s data and systems. To have a fighting chance, you need a ransomware mitigation strategy.
Cybercriminals use ransomware to orchestrate attacks on businesses and consumers 24/7/365. Ransomware attacks usually start with a malicious email as part of a targeted phishing scam. Ransomware mitigation leverages insights and intelligence, appropriate security policies, and company-wide protection technologies.
For most organizations, managing all of this alone is overwhelming and expensive. Managed detection and response (MDR) offers a comprehensive, cost-effective approach to ransomware mitigation.
What is Ransomware Mitigation?
Ransomware mitigation involves a series of best practices and tools that focus on each of these aspects.
About Ransomware Mitigation
Smart companies develop and deploy multiple layers of ransomware mitigation that encompass prevention, detection, and response. Ransomware mitigation involves a series of best practices and tools that focus on each of these aspects. For example, prevention may involve deploying multifactor authorization (MFA) and regular backup of data. Prevention also includes providing regular employee training to help users recognize the signs of a phishing attack that may be linked to ransomware. Detection focuses on monitoring for any signs of suspicious behavior linked to ransomware. The best ransomware detection leverages endpoint detection and response (EDR) or managed detection and response (MDR), as well as extended detection and response (XDR). And finally, response to a ransomware attack involves incident investigation and forensics, as well as sophisticated threat hunting to get the most value out of your ransomware mitigation efforts.
Can Ransomware Be Detected?
The average user may not detect a ransomware attack on their systems until it’s too late.
The average user may not detect a ransomware attack on their systems until it’s too late. However, trained security professionals with the right detection and response tools can often spot unusual activity that may indicate a ransomware attack is imminent. There are a few different techniques security professionals use to detect ransomware attacks. They involve a mix of automation and human investigation and analysis to discover malicious files early. An example of automation is signature-based ransomware detection, which compares a ransomware sample hash to known signatures. Endpoint detection and response platforms and Next Generation Antivirus software can work together to monitor, capture and analyze data extracted from an executable file to determine whether it’s ransomware. Most antivirus software takes this step in a scan for malicious software. Behavior-based ransomware detection is more in-depth. Experienced security analysts know that ransomware’s behavior is its Achilles' heel, which is why professionals in a Security Operations Center (SOC) spend so much time studying it. Security professionals use their expertise along with robust tools to compare recent behaviors within the network or systems against average behavioral baselines. For example, has an employee accessed a desktop machine remotely from another state, when the employee has been logged in from the office all day? Security teams can examine traffic patterns for any anomalies and further investigate anything that appears suspicious.
MDR for Remediation
With MDR, your company’s data and systems are backed by a team of experienced threat hunters, engineers, ethical hackers, and security operations specialists.
Ransomware Remediation with MDR
An MDR provider delivers around-the-clock security monitoring across its IT environment. It also ensures that a company can proactively hunt for ransomware and other cyber threats and protect against them. With MDR, your company’s data and systems are backed by a team of experienced threat hunters, engineers, ethical hackers, and security operations specialists. Together, these cybersecurity professionals search far and wide for cyber threats like ransomware. If any threats are identified, they are resolved right away. The threats are also evaluated, ensuring a company can protect against such issues moving forward.
New ransomware variants are created and released every day. The only way to mitigate harm is to detect and block ransomware before it can take root. The result is a continuous struggle between defenders, with their security controls and detection systems finely tuned to spot suspicious code and behavior, and adversaries, with their ever-evolving bag of tricks designed to outfox these controls – or to get the job done before the controls catch up with them.
Vea cómo las tecnologías de Sophos trabajan de forma conjunta para obstaculizar las múltiples fases de un ataque del ransomware Ryuk:
Aplique las prácticas recomendadas en todo momento
Siga estos consejos para minimizar el riesgo de un ataque:
- Utilice la autenticación multifactor (MFA).
- Utilice contraseñas complejas, administradas mediante un gestor de contraseñas.
- Limite los derechos de acceso: dé a las cuentas de usuario y a los administradores solo aquellos derechos de acceso que necesiten y ninguno más.
- Realice copias de seguridad periódicamente y manténgalas fuera de la red y en ubicaciones externas donde los atacantes no puedan encontrarlas.
- Aplique los parches con prontitud y frecuencia. El ransomware como el WannaCry y el NotPetya dependía de las vulnerabilidades sin corregir para poder propagarse por el mundo.
- Bloquee su RDP. Desactive el RDP si no lo necesita y utilice limitación de velocidad, 2FA o una VPN si lo necesita.
- Asegúrese de que la protección contra manipulaciones está activada: el Ryuk y otras variantes de ransomware intentan desactivar la protección de sus endpoints.
* Estado actual de la seguridad para endpoints, Sophos, 2018