Ransomware attacks have dramatically increased over the last several years. Unfortunately, they are evolving from a simple ransom, to ransom plus threat of disclosure, and using captured information to commit additional fraud. Our cybersecurity consulting knowledge on Ransomware Readiness was split into different E-Focus articles. This article is the first one out of four, and it is focused on protection and prevention.

The best way to protect an organization from ransomware is to stop the attack before it can infect any systems. Easier said than done, but with the right combination of people, process, and technology the likelihood of a successful infection can be dramatically reduced. The critical items we recommend focusing on include:

• Multifactor Authentication – protecting your email, remote access and all administrator access with multifactor authentication drastically (over 90%) reduces the likelihood of a successful attack. 
• Email Security – use the best practices for your email solution (e.g., Office365, Google, Exchange, etc.) to cut down on spam and spoofed emails (e.g., SPF, DKIM, and DMARC), require multifactor authentication, and disable legacy authentication methods.  Many cloud solutions now offer advanced filtering and anti-malware detection; these should be considered as part of the overall proactive controls strategy.
• Security Awareness Training – make the people in your environment human firewalls by training them and encouraging reporting. Adapted to each organization's culture, consider gamifying the training to make it more interesting, engaging, and fun. 
• Network Security – if ransomware sneaks through, it will eventually make contact with its command and control server for instructions. Network security controls, such as firewall rules, can prevent the ransomware from receiving “activate” instructions. Network security tools can also alert IT about the event.

Every protective technology can eventually be circumvented, so throughout these articles we will focus on layers to protect, detect, and recover. Similarly, every environment is different, so the specific technology solutions and processes will vary and need to be carefully considered for each environment.

RubinBrown has decades of experience in the cybersecurity industry, helping clients implement best practices to secure their online environments and educating them on how to prevent potentially harmful ransomware attacks. Discover our diverse     consulting services and learn how we can support your business today.

^{Readers should not act upon information presented without individual professional consultation.}

^{Any federal tax advice contained in this communication (including any attachments): (i) is intended for your use only; (ii) is based on the accuracy and completeness of the facts you have provided us; and (iii) may not be relied upon to avoid penalties.}

Published: 09/30/2022

_{^{Readers should not act upon information presented without individual professional consultation.}}

_{^{Any federal tax advice contained in this communication (including any attachments): (i) is intended for your use only; (ii) is based on the accuracy and completeness of the facts you have provided us; and (iii) may not be relied upon to avoid penalties.}}