Ransomware attacks have dramatically increased over the last several years and are aggressively targeting all industries. Based on recent study performed by an international government security agency, the United States and Europe have the most targeted attacks, but attacks are occurring all around the world. This E-Focus is the second of four articles we will present on Ransomware Readiness – this article is focused on detection and eradication. 

In the cyber security world, we assume protective controls will eventually fail or be circumvented. If the protective measures taken have failed and ransomware is on a system, what now?  The first goal is to detect the malware in the environment, isolate it, and eradicate it before it can do additional harm. Early detection of malware can significantly reduce the negative impacts of a breach or ransomware attack. The following are important areas to address as part of your detection and eradication strategy:

• Endpoint Security – if ransomware sneaks through, endpoint anti-malware may be able to detect, alert, and eradicate the threat. Basic antivirus may not be as useful, but new endpoint solutions are being offered that greatly reduce the malware threat. 
• Network Monitoring – as mentioned in the Protection E-Focus, detecting malware “phoning home” (and ideally blocking it) to receive instructions, allow access back into the environment, or exfiltrate data can provide an alert of a malware incident. Early detection can assist with the next steps of isolation and eradication.
• Anomaly Detection – generally a combination of monitoring systems and networks with machine learning solutions can be used to detect abnormal behavior. Used in combination with the other technologies, these solutions can be used to identify intrusions and attacker trying to move within an organization.
• Human Firewall – as mentioned in the Protection E-Focus, security awareness can help create “human firewalls” who report possible issues or changes they notice in the environment.
• Incident Response Plan – planning out how the organization will act in the event of a significant security incident can make a huge difference in how long an incident lasts and the level of chaos during the response effort. Ideally Incident Response Plans are formally documented and tested at least annually.

The mix of people, process, and technology used to provide effective, layered, detection and eradication controls will be unique to each organization.  The items listed above are areas that need to be considered as part of the enterprise security plan.

As always, if you need information or assistance with cyber security, please feel free to contact the RubinBrown’s Cyber Security teams at any time.

^{Readers should not act upon information presented without individual professional consultation.}

^{Any federal tax advice contained in this communication (including any attachments): (i) is intended for your use only; (ii) is based on the accuracy and completeness of the facts you have provided us; and (iii) may not be relied upon to avoid penalties.}