CS Mar Apr 2022

ansomware
a plethora of networks, applications and
storages. However, the dilemma is that it
is no longer feasible, or even possible, to
consider all elements of the service topology
as 'trusted'. Zero Trust is a critical concept,
because it brings security to the users, data/
information, applications, APIs, devices,
networks, cloud etc wherever they may be -
instead of forcing them onto a 'secure'
network.
"The cybersecurity industry is more difficult
to navigate than ever before," he adds.
"Continuous data breaches and ransomware
attacks, which are impacting commercial
entities and governmental agencies, prove
that network-centric approaches no longer
work. The industry needs to establish
standards and best practices for Zero Trust
as the overarching information security
approach for the digital age and create
models that are data- and asset-centric,
as opposed to traditional network-centric
approaches."
DEPLORABLE STATE OF SECURITY
The only success story we can attribute to
ransomware is publicly benchmarking its
victims on the deplorable state of their
organisation's security, says Ian Thornton-
Trump, chief information security officer
for Cyjax. "Although sensational headlines
about a company becoming a victim and an
endless stream of cyber security vendor fear,
uncertainty and doubt related to 'protection
from ransomware', it seems most people
have missed the point. A cyber security event
that involves ransomware is the result of
one or more cyber security failures at a
technological or human level. In short,
ransomware is the symptom of the disease
of poor cyber security, not something which
'just happens'."
He likens ransomware's impact on an
organisation to the three-act structure model
used in narrative fiction that divides a story
into three parts (acts). Often called the
'Setup', the 'Confrontation' and the
'Resolution', it was popularised by Syd Field in
his 1979 book 'Screenplay: The Foundations
of Screenwriting'.
THE SETUP
In the beginning, systems are brought to
their knees - outages happen. that's a fact of
life, but it becomes sinister the moment you
are told the files are stolen, encrypted and
you must pay not to have them publicly
dumped and pay for a decryption key and
software. "Just a point here. If you claim you
are investigating a 'cyber security incident'
and its ransomware, and yet it takes you
more than a week to inform customers and
regulators, you may need to question your
organisations capacity for incident response
and understanding of governance, risk and
compliance."
THE CONFRONTATION
The middle of a ransomware event is
the 'chaos' of the event itself, requiring
extraordinary efforts to restore services and/
or negotiate with the attackers. This is the
organisation in 'true' crisis where the very
worst days of everyone's working life are
being played out. "The only word that can
adequately describe the feeling is profound
'tragedy' - it's a loss against malicious actors
and all the stages of grief are played out as
a mad hunt is on for the install CDs, the
licence codes and the backup tapes. It's an
extraordinary stressful time and the single
most destructive words to utter at this
moment are: 'I told you so'."
THE RESOLUTION
The end of the event is the realisation, after
the extraordinary expenditure of time, effort
and money, that the ransomware could have
been prevented, mitigated, if only the security
expense, life cycle management, asset
inventory etc
had all been done proactively. Every ransomware
event comes with a healthy amount of
hubris and lessons learned - only if the post
event discussion happens. Most organisations
survive a ransomware event, but it's financial
impact and customer trust may take years to
repair.
"When we examine the big ransomware
stories - at least the ones that share deep
technical details - there are always items
which we could have done better or been
more prepared for," continues Thornton-
Trump. "Since the first crypto locker viruses in
2015, it's hard to be sympathetic towards
organisations that succumb to this attack in
2021, but it's understandable. If you think
ransomware is what you need to protect your
organisation against, you're missing the story.
Ransomware is telling you about the state of
your security."
FINANCIAL INSTITUTIONS
TAKE A BATTERING
"Financial institutions are facing rising cyber
threats and the warning from the FCA serves
as a reminder that no business is safe from
attack," says Fabien Rech, VP EMEA, Trellix.
"We recently found that the financial services
industry accounted for 22% of ransomware
and 37% of Advanced Persistent Threat
detections in Q3 2021. As cybercriminals
adapt their methods to target the most
sensitive data and services, FS firms must
shore up their defences to mitigate further
threats."
How exactly? "They must deploy a security
strategy that includes a living platform that
can learn and adapt defences based on the
threat. This platform generates and prioritises
comprehensive threat insights from both
outside and inside the company to adaptively
strengthen detection, and it responds in realtime
to active threats."
According to research findings from Trellix,
in the third quarter of 2021 "high-profile
ransomware groups disappeared,
reappeared, reinvented and even attempted
to rebrand, while remaining relevant and
prevalent as a popular and potentially
devastating threat against an increasing
spectrum of sectors. Even though
www.computingsecurity.co.uk @CSMagAndAwards Mar/Apr 2022 computing security
29