Ransomware attacks against corporations is such a common problem that it has even made its way into television plots. Both seasons of the popular Mr. Robot television series on USA network focus on a series of ransomware attacks against a large conglomerate known as Evil Corp. In the show, the hackers are smart enough to encrypt both the primary and secondary copies of the data they are wishing to impact. Believe it or not, some of the real hackers are that smart as well.
During our recent live webinar, “Ransomware – Five Reasons You’re Not As Protected As You Think”, my colleague George Crump made the point that one of the things surprising him is how effective ransomware is, until he realized that it attacks us in two very vulnerable places: backups and end-users. Both are areas that have been problematic for companies throughout the years.
Backups have been a challenge of constantly fighting the laws of physics. Backup system designers constantly fight physics because data sets continue to get bigger while backup windows continue to get smaller. The first data center I worked in was for a $35 billion international credit card company, and a full backup of the data center would now fit on an SD card that costs $100. Every user has significantly more storage available to them than was conceivable just a few years ago, and they have a number of ways to fill that storage very quickly. This is why backup system designers are always fighting physics.
End-users are always a challenge. They don’t think about, nor do they understand security. At the credit card company where I worked, we had an entire information security department whose job it was to constantly educate the end-users about things such as phishing (although we didn’t call it that back then). We would tell them over and over that no one from the IT department will ever call you and ask you for your password – ever. Then we had a team of people who would regularly call around and ask people for their password as a test. Every single person on that team got someone to give them their password every single day.
In addition to end-users not really thinking about security as much as we would like them to, hackers are developing ways to get around even security minded people. In the same webinar George was in, Gary Watson from Nexsan talked about something they call spearphishing. That is where email attacks are specifically tailored to your organization. They look like emails that are coming from internal people using your internal jargon. All they need to do is get one end-user to bite.
If the topic of ransomware interests you (or scares you) and you want to learn ways to protect your organization, make sure to check out the on-demand version of this webinar available here.
*Mr. Robot and USA Network are copyrights of USA Network