The repercussions of the Colonial Pipeline, JSA and Kaseya VSA product ransomware attacks may have spooked its attackers into laying low for a bit, but it won’t last.

While there’s still money to be extorted, the gangs will continue to scan for victims and craft attacks. And, as we’ve seen in 2021, they’ll be indiscriminate in the targets they pursue.

That’s led to some pretty interesting developments, including attempts to establish international ground rules on sectors that should be off-limits to a cyber attack.

In reaching that point, it’s probably also time we faced up to some ‘home truths’ about the ransomware scourge and how we arrived at this point.

The attack surface is big

The need to rapidly roll out remote work on a vast scale left IT departments with little time to fully consider new security architectures and the threat landscape. In some cases, apps were visible to the public-facing internet, where they could be discovered and attacked.

These structures are now becoming permanent, with many web-scale organisations making a ‘three days at the office, two days at home’ hybrid work week as standard. This calls for new models of presenting enterprise apps to remote workers while shielding those apps from unwanted attention.

With a distributed workforce, organisations need to implement a secure access service edge (SASE) architecture that can enforce consistent security policy no matter where the users are working (in-office or remotely). Zero trust network access (ZTNA) can also help hide apps from discovery and restrict access to a set of named entities.

Businesses pay up

Every government cybersecurity agency recommends not paying ransoms, and yet enough victims do so for ransomware to continue to be a lucrative endeavour.

There’s a wide cross-section of responses on how many companies admit to paying a ransom. One survey says 32% of victims paid up, another says 20%, and a hird survey says 56% - all within the last three months.

It’s likely payments fall on the higher side since many companies still won’t admit to paying. There’s reputational damage in falling victim to ransomware, but further embarrassment at ignoring the official advice and paying up - whether that’s for decryption keys or under duress to avoid a costly leak of stolen data.

One thing is certain: ransomware won’t stop while it remains lucrative, and only a fraction of payments are ever recovered.

Seeing double

Zscaler’s recent Ransomware Report highlighted a trend of double-extortion” attacks. These have emerged because victims stopped paying and chose to wipe their environments and restore from backup.

To counter this, attackers now encrypt data and also steal it. Even if they can recover the data from backups, affected organisations are then threatened with public exposure of their stolen data by criminal groups demanding ransom. In late 2020, the team noticed that this tactic was further augmented with synchronised DDoS attacks, overloading victim’s websites, and putting additional pressure on organisations to cooperate.

Businesses are leaky

The larger the organisation, the more likely it is to unintentionally leak information that would be valuable in the hands of adversaries.

Nowadays, companies publish more information about their infrastructure online than they should, and they are often entirely unaware that they have done so. Sometimes an incorrectly configured server is leaking data, or a hastily established development environment might be acting as a gateway for attackers to access critical data, or perhaps a simple open port is the culprit.

The internet also invites attackers to gain an in-depth knowledge of a company’s infrastructure, enabling them to execute targeted attacks at its weakest points. A firewall, for example, can give attackers unintended insight into a company’s structure; it may provide information on network names and domains in internal environments, which, in turn, can be used to identify potential areas for attack.

Understanding how attackers gain access is imperative for an organisation to implement appropriate measures to ensure that only authorised users obtain access to the necessary applications.

People get pwned

Attackers also focus their efforts on the weakest link in the security chain - people. The

OAIC Notifiable Data Breaches Report for the period July - December 2020 stated that “data breaches resulting from human error accounted for 38% of notifications, up 18% on its previous six month report”.

Australian Information Commissioner and Privacy Commissioner, Angelene Falk, says “The human factor is also a dominant theme in many malicious or criminal attacks, which remain the leading source of breaches notified to my office.

“Organisations need to reduce the risk of a data breach by addressing human error – for example, by prioritising training staff on secure information handling practices.”*

We all know how essential it is for companies to train their people to spot security risks, yet in many cases, ransomware infections still occur due to people clicking on things they shouldn’t.

Knowing this, it’s more important than ever to conduct regular security awareness employee training. At the same time, developing a culture of openness whereby employees are encouraged to question unusual requests, regardless of whether they emanate from a colleague’s email account or the CEO is also critical.