When your CEO says,
“I NEED TO DISCUSS HOW THE COMPANY IS PROTECTED AGAINST RANSOMWARE”.
Here is what you need to do.
I am sure many of you are have received countless emails recently from IT vendors telling you to buy their hardware or software because it is the “best way to protect against Ransomware”. This is all well any good, but right now, you are probably more concerned with what you are going to tell your CEO when he or she asks
“What measures do we have in place to protect us against Ransomware attacks”
or
“Are we open to attack?”
Ransomware is one of the fastest growing industries on the planet. There isn’t a week goes by without talk of somebody being attacked or a new threat emerging. The reason; because it is incredibly profitable for its creators, who are also difficult to trace.
Ransomware is always evolving and becoming more sophisticated. Like any malicious code, it is often designed to attack the unprepared.
CRYPTOLOCKER AND ITS DERIVATIVES
Most Ransomware attacks use software, such as Cryptolocker or its derivatives, which enters a corporate network attached to an official looking email. Often this looks like an invoice or other official document and is addressed to a member of staff.. Opening the attachment will immediately encrypt the data on the owner’s PC and any attached file servers. This is swiftly followed by a message saying “pay a ransom in the next few days or your data is gone for good.” Not a lot of fun and quite scary for the individual and the owners or the company.
WANNACRY – RANSOMWARE STEPS UP A GEAR
More recently ransomware has taken a new twist. “WannaCry”, also known as Wcry, WanaDecrypt0r or WannaCryptor works by exploiting a security hole in the Windows operating system. Microsoft issued a patch in March2017, but any systems that haven’t been kept up to date with security patches are vulnerable.
This doesn’t need human interaction for the infection to occur so, the attack can be much more widespread. The number of computers that can be infected by this type of ransomware virus can quickly run into hundreds of thousands. The effect to the user and the target organization is the same. The user’s system is encrypted and a ransom notice flashes up on their screen. However, the infection can spread to multiple systems in a single organization if systems aren’t patched up to date.
WHAT CAN YOU TELL YOUR CEO?
This conversation can follow two routes:
- This is what we have in place.
- This is what we need to buy.
The second option is likely to be less well received, but it is also a great opportunity to get funding for something you really do need, to protect the organization.
So, let’s look at the measures you can take:
- Patch your systems: This is an easy one, unless you have a lot of systems. It just involves time. If you don’t have time, you should suggest that you outsource the patching to an external managed service company, who can manage it for you.
- Invest in some good quality anti-virus software: Anti-virus software vendors make it their job to protect you against the latest virus strains and will happily tell you if their software protects you against Ransomware viruses. This makes it easy to see if your software is up to the job. Again, if you don’t have suitable software, you can sign up for a managed antivirus service so someone else can make sure you are protected.
- Check your firewall: Firewalls are designed to protect against outside attacks. A recent blog article from SonicWALL, illustrates that they and other vendors are on top of things. Look for similar statements from your firewall vendor. If they can’t provide this, look to your CEO for budget for a replacement.
- Update your Backup Software: This may not be as obvious, but this can be your last and best line of defense. If you assume that you will, at some point get infected, having the ability to recover systems without paying a ransom is quite important. Modern back up software, that takes regular snapshots throughout the day and has the capability to spin up virtual machines, it the best way to avoid paying a ransom. The infected system or systems can be isolated, formatted and re-imaged from a recent clean backup in a matter of minutes. Clean virtual machines can also be spin up from the last clean backup, to replace the infected ones.
This eBook goes into more detail and gives an example of where Abtech was able to recover our client’s main file server in less than an hour with less than 5 minutes of data changes lost.
THE MEETING WITH THE CEO – A HAPPY ENDING
Armed with this information you can go into that meeting with the CEO fully prepared. Making a statement like this:
“All our systems are up to date and we have protection through our firewall and antivirus software, but I recommend we invest in a new backup system to ensure we can recover quickly if we are attacked”
will reassure your CEO and senior management even if it may cost them some money.
FURTHER RESOURCES AND ACTIONS MICROSOFT RECOMMEND YOU TAKE:
Download English language security updates: Windows Server 2003 SP2 x64,Windows Server 2003 SP2 x86,Windows XP SP2 x64,Windows XP SP3 x86,Windows XP Embedded SP3 x86,Windows 8 x86,Windows 8 x64
Download localized versions for the security update for Windows XP, Windows 8 or Windows Server: http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598
Read general information on ransomware: https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx
Download MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
FAQs:
WHERE CAN I FIND THE OFFICIAL GUIDANCE FROM MICROSOFT?
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
IS THE UPDATE AVAILABLE FOR WINDOWS 2003 & WINDOWS XP AS WELL?
Yes. The link for download of the update is available at the end of this article
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
WILL THE UPDATE RUN ON UNLICENSED WINDOWS?
It is recommended that the update is run on a licensed version.
WHAT ABOUT WINDOWS 2003 R2?
The Windows 2003 update should get applied on Windows 2003 R2 as well.
WILL THE INSTALLATION OF THE PATCH, PREVENT THE OCCURRENCE OF RANSOMWARE?
No. Applying MS17-010 is just preventing the malware from spreading, not giving protection against the infection itself. Based on reports, this malware is using Social Engineering to target companies.Please warn your users to not open, click or enable macros on email reception.
- The priority is that your anti-virus can detect the malware.
- Verify that you have up-to-date signatures, along with patching the Windows systems
- Make sure that users have the level of knowledge required to never click on suspicious attachments even if they are displayed with a familiar icon (office or PDF document). Where an attachment opening offers the execution of an application, users must under no circumstances should accept the execution and in doubt, users should you consult and/or consult the administrator.
- Implementation of strong filtering in O365:
- Exchange Online Protection
http://TechNet.Microsoft.com/en-us/library/jj723164(v=Exchg.150).aspx
http://TechNet.Microsoft.com/en-us/library/jj200684(v=Exchg.150).aspx
http://TechNet.Microsoft.com/en-us/library/jj723119%28V=Exchg.150%29.aspx
SECURITY TIPS TO PROTECT AGAINST RANSOMWARE
IS THE RANSOMWARE EFFECTIVE ONLY IF THE USER HAS ADMINISTRATIVE RIGHTS ON THE CLIENT MACHINE?
No. This piece of ransomware, like most of others, once executed, encrypts all files it can reach in the context of a user, if the user is an admin on the box the outcome is more devastating. In addition, this ransomware also tries to disable shadow copies and make some registry changes in HKLM hive which require administrative privileges.
When it tries to spread, it uses a vulnerability, which once exploited gives the malware SYSTEM level access on the target system. All this means that this attack maybe very successful and destructive even if the users don’t have admin privileges on their unpatched workstations/servers.
IS ONLY DISABLING SMB V1 SERVER (LANMANSERVER) ON ALL OUR MACHINES HELPS US TO PROTECT FROM THIS VULNERABILITY?
Patch installation would be the first option. To answer the question, Yes. SMBV1 should be removed, but in a planned way. Please refer the below link
https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/
DO WE NEED TO DISABLE SMB V1 CLIENT (LANMANWORKSTATION) AS WELL ON ALL OUR MACHINES?
No. It is only the SMBv1 server component (which means Lanmanserver), on the client machine and not Lanmanworkstation on the client machine.
WHAT IS THE IMPACT OF REMOVING SMBV1?
- You’re still running XP or WS2003 under a custom support agreement
- Windows XP will not be able to access shares on a Windows 2003 Server or any other Operating System
- Windows Vista and above Operating System will not be able to access shares on a Windows 2003 Member Server or Domain Controller (if you still have them in the environment)
- You have some decrepit management software that demands admins browse via the ‘network neighborhood’ master browser list
- You run old multi-function printers with antique firmware in order to “scan to share”
Please refer the below article for more details
https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/
IF WE MUST DISABLE SMB V1 SERVER SERVICE, WHAT ARE THE REGISTRY VALUES TO DISABLE IT?
When using operating systems older than Windows 8.1 and Windows Server 2012 R2, you can’t remove SMB1 – but you can disable it: KB 2696547- How to enable and disable SMBv1, SMBv2, and SMBv3 in Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012
Please refer to the below link for more details
https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/
HOW DO WE KNOW SMB V1 IS ACTIVE IN OUR ENVIRONMENT? CAN WE PROACTIVELY CHECK IT?
Yes. Please test this, before using in the production environment.
Windows 2016 and Windows 10 provides a way to audit usage of SMBv1, which can be found here
https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/
IS WINDOWS 10 AFFECTED AS OF NOW?
https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/
The exploit code used by WannaCrypt was designed to work only against unpatched Windows 7 and Windows Server 2008 (or earlier OS) systems, so Windows 10 PCs are not affected by this attack as of now.
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
Customers running Windows 10 were not targeted by the attack today.
Windows 10 systems also need to be patched, because the variants can be developed. In addition to this, it would be recommended to remove SMBv1 from the clients and Windows servers, after doing a complete review of the below mentioned article.
https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/
