5 Steps to Prevent Ransomware

0:00 hi and welcome back to my channel

0:02 ransomware is the biggest threat to a

0:04 business i don't know of any business

0:05 that be able to continue operations

0:07 without their data for more than a few

0:09 days

0:10 even though your data may have been

0:12 moved to the cloud you're still at risk

0:14 and it's your responsibility to protect

0:16 the continuity of your business

0:18 hi i'm steve murphy i'm a vice president

0:20 at arg and while i work for arg this

0:22 video is my own and not necessarily

0:23 reflection of the views or opinions of

0:25 my employer

0:26 ransomware is becoming more and more

0:28 prevalent the bad guys are getting

0:30 better at sidestepping preventive

0:31 measures we put in place

0:33 it's an old adage but one that applies

0:35 to ransomware attacks it's not a

0:37 question of if but when

0:39 now everyone needs to view their

0:41 business as a target threat actors are

0:44 not interested in disrupting your

0:45 business because they dislike you or

0:48 what you do

0:49 they want to your business so

0:50 you'll pay them to restore your ability

0:53 to operate

0:54 businesses of all shapes sizes and

0:57 industries need to be aggressive in

0:59 protecting their organization's ability

1:00 to continue functioning

1:02 if you have a bank account you are a

1:04 target the bad guys don't care what you

1:06 do

1:08 i've assembled five steps to help you

1:09 protect your organization from a

1:11 ransomware event

1:12 at the end of the video i'll share a

1:14 non-it best practice for you for when

1:17 ransomware strikes your organization

1:19 so here we go with step number one

1:22 know what you have

1:24 this seems pretty basic but it's

1:25 astonishing how many organizations think

1:28 they know what they have but upon a

1:30 complete inventory

1:31 they discover numerous network segments

1:33 or cloud services that house data that

1:35 were previously unknown

1:37 a recent study from veritas claims that

1:40 as much as 35 percent of data is unknown

1:43 to the it organization

1:45 now

1:46 take the 35 with a grain of salt veritas

1:49 is in the data protection business so

1:50 that number might be a little inflated

1:52 but if it were 20 percent would you feel

1:54 much better i don't think i would

1:58 threat actors seek out these forgotten

2:00 packets of data

2:01 that's where the vulnerabilities are

2:03 most likely found that's where network

2:05 scanning is likely missing

2:07 and that's where they can establish a

2:08 foothold and start reconnaissance on the

2:10 rest of your network

2:12 to inventory your data and

2:13 infrastructure you can either conduct an

2:15 old school survey or utilize an

2:18 automated scanner to search out and

2:20 index your data automated approaches

2:23 will give you the best results from from

2:26 a cataloging and mapping perspective but

2:28 it may not capture that 20 to 35 percent

2:31 of unknown assets in the organization

2:34 after the automated approach examine the

2:36 categorization see if you can identify

2:38 gaps

2:39 and use that data to create an old

2:41 school survey to help you confirm that

2:43 you have a good inventory it may lead

2:46 you to as yet undiscovered data

2:49 tip number two

2:50 automate detection

2:52 what's the worst way of

2:55 detecting or discovering an incident on

2:56 your network

2:58 having a user come to you saying my

2:59 stuff isn't working anymore that's the

3:02 absolute last way you want to discover

3:04 an incident yet for many mid-size

3:05 organizations that's the only way they

3:07 know that they're under attack

3:09 the best way to defend against a

3:11 ransomware attack is to keep it out

3:13 that's a no-brainer but the second best

3:16 way of defending against a ransomware

3:17 attack is to stop it early

3:20 establishing tools to detect and shut

3:22 down suspicious activity gets you

3:24 playing offense rather than constantly

3:26 playing defense

3:28 the traditional way of accomplishing

3:29 this is to implement a security

3:31 information and event management system

3:34 an s-i-e-m or pronounced sim

3:37 the traditional sims are excellent at

3:39 identifying known threats based upon

3:41 iocs or indicators of compromise

3:44 and documented behavior patterns the

3:46 problem is today's threats change each

3:49 time they're installed so what's been

3:51 documented about them in the past

3:53 may not be present in today's version

3:56 leaving traditional signature base

3:57 detection at a disadvantage

4:00 the better sims have been upgraded with

4:02 threat detection

4:04 using artificial intelligence and

4:05 machine learning that scan the network

4:08 for unusual behavior that might be signs

4:10 of a threat

4:11 unless your organization is very large i

4:14 recommend using a managed security

4:16 service provider mssp essentially a

4:18 vendor to monitor all these services

4:20 it's very difficult to staff monitoring

4:23 around the clock and mssps are experts

4:26 in finding and remediating threats

4:28 because of the volume that they see

4:30 now these platforms are not 100

4:32 guaranteed to stop the bad guys but they

4:35 are an integral layer in your cyber

4:37 security posture

4:39 so let's go down to step number three

4:41 limit access

4:43 ransomware is introduced and transmitted

4:45 by hosts if you can limit the visibility

4:47 of a host

4:48 to just the need to know services on

4:50 your network then you can limit

4:52 potential damage of a ransomware attack

4:55 xero trust has received a lot of buzz

4:57 and zero trust is a great solution but

4:59 it's hard and expensive to get a full

5:01 zero trust posture

5:03 the next best thing is to isolate based

5:05 upon personas or profiles the system and

5:07 data that are available to a user make

5:10 sure that you have limited permissions

5:12 for your it teams based upon need and

5:14 that those credentials are secured with

5:16 multi-factor authentication and never

5:18 allow one account to have universal

5:21 access to all systems

5:23 check executive permissions executives

5:26 seem to be the most over privileged and

5:28 most targeted in organizations at least

5:30 according to what i've seen

5:32 step four back up and back up again

5:34 i think every company i've met has a

5:36 business continuity strategy involving

5:38 off-site backups that's great

5:40 this strategy used to be the best

5:42 defense against ransomware if you had a

5:44 clean backup you could restore your

5:46 systems and ignore the ransomer

5:48 but the bad guys are smart once backup

5:51 started eating into the ransom revenue

5:53 they started targeting backup systems

5:55 the backup is not much of a backup if

5:58 it's if it too is encrypted or deleted

6:00 by the attacker

6:02 today's backup strategies typically

6:04 follow a three two one methodology three

6:07 versions of your backup using at least

6:09 two different media with one being off

6:11 site and air gap

6:13 this has been an effective strategy for

6:15 the last several years

6:17 now that ransomware attackers are

6:18 actively targeting backups a three two

6:21 one plus one strategy is recommended the

6:24 plus one

6:25 is where you have one of your copies

6:29 in an immutable and indelible

6:31 environment

6:32 immutable and indelible backups can no

6:34 longer be changed or deleted they cannot

6:36 be encrypted by any attacker

6:40 they come at a cost but if your data

6:42 needs to survive immutable backups are a

6:45 key component of your disaster void

6:46 strategy

6:48 last step step five

6:50 practice your disaster scenarios i know

6:53 everyone is busy in practicing recovery

6:56 processes is one of the lower items on

6:58 your priority list but it's important to

7:01 know

7:01 that your team and your vendors know the

7:04 rules i suggest you try to make it

7:06 entertaining start by grabbing everyone

7:08 for a meeting maybe make it a lunch even

7:10 if it's virtual and have everyone walk

7:12 through their roles and responsibilities

7:15 you can gamify it by awarding points to

7:17 the most complete walk-throughs or most

7:19 improved from one practice session to

7:21 another maybe the winners get an early

7:23 afternoon off or something

7:25 you want to increase the rigor and

7:27 reduce the time to prepare for these

7:29 drills as your team becomes more

7:31 familiar with their responsibilities

7:33 eventually you want to get to a place

7:35 where you can conduct a mock event and

7:37 have your team go through actual steps

7:39 in a fenced off environment if that's at

7:42 all possible

7:43 so these five areas of focus will

7:45 provide you and your organization the

7:47 best chance of

7:48 of surviving and recovering from a cyber

7:50 event

7:52 i also suggest that you keep these five

7:54 areas top of mind so you can recite your

7:56 preparedness strategy quickly when asked

7:59 nothing compromises confidence when a

8:01 fumbled answer to a question like what

8:04 are we doing to protect our company from

8:05 ransomware from your ceo

8:08 okay

8:09 so those are the five steps and a little

8:11 encouragement to keep it top of mind now

8:13 here's the bonus non-it recommendation

8:16 when ransomware strikes have someone

8:19 not you because you're going to be

8:21 really busy doing other things but have

8:22 someone in your organization call your

8:25 attorney first

8:26 before contacting the ransomer or before

8:28 making any external moves

8:30 now if you have

8:32 if you have a cyber insurance call the

8:34 cyber insurance company they will refer

8:36 you to a lawyer who is experienced in

8:40 ransomware but ransomware has several

8:42 dangerous legal and regulatory

8:44 implications we don't want to make the

8:46 incident worse by going through it

8:48 without legal counsel

8:51 so that's it if you have any questions

8:54 or would like to learn more about

8:55 vendors or and solutions around these

8:57 steps feel free to contact me my email

8:59 address is in the description of this

9:01 video

9:02 if you got some value from this video

9:04 i'd appreciate a like by hitting that

9:05 thumbs up button below and to return to

9:07 my channel in the future the easiest way

9:10 to do that is to hit the subscribe

9:12 button that will put my videos in your

9:14 feed and you can come back at your

9:15 convenience

9:17 thanks very much for watching and i hope

9:18 you have a great day