CS Jul-Aug 2023

ansomware
WHY BEING AGILE MATTERS WHEN
IT COMES TO A RANSOMWARE ATTACK
STEVE USHER, SECURITY SERVICES MANAGER, BROOKCOURT SOLUTIONS, OFFERS HIS EXPERT INSIGHTS
Over the course of the last few years,
we have witnessed too many highprofile
companies being featured
in the media who have fallen victim to
ransomware demands. In that moment,
as a business leader, what are your first
thoughts? Imagine for that moment what it
might be like if your organisation was hit by
an attack - would you be ready?
Ransomware attacks are one of the most
significant and rapidly evolving threats in
the cybersecurity landscape. The damage a
ransomware attack can cause to a business
doesn't bear thinking about. The financial
loss, data loss and operational disruption
will all take a toll on the overall reputation
of an organisation.
For senior management, understanding
how and why ransomware attacks happen
is incredibly complex, especially without
knowledge of vulnerabilities, code or a clear
view of the methods, motivations and
current activities of cybercriminals.
In a recent example, a senior security
analyst joined top executives from a Fortune
500 company. He joined the meeting cold,
not knowing what to expect, and was able
to eloquently conduct a live review of threat
intelligence, using the latest technology.
The client struggled to comprehend the
level of detail and how exposed the
business actually was, leading to a greater
understanding and hence the security
posture was elevated.
The threat of ransomware is constantly
evolving and we need to always remain
'threat aware'. It's a game of cat and mouse
where we may often only learn from being
exposed. However, our true strength comes
from how we recover with agility. We need
to educate business leaders to understand
the threat will always be there. There is no
escape; regularly reviewing your security
posture and investing in your cyber security
is paramount to protect your business,
stakeholders and your data.
Here's the five-point plan for better
resilience:
1. Rapid Response: Time is of the essence
in mitigating the impact of a ransomware
attack - helping businesses understand the
key next steps to identify and contain the
attack, minimise its spread and prevent
further damage. Delayed response can lead
to increased data loss, extended downtime
and higher financial costs for the affected
organisation
2. Adaptive Solutions: Ransomware attacks
constantly evolve, with new variants and
techniques emerging regularly. Being ready
to adapt tools, techniques and approaches
to counter an evolving threat is paramount,
having access to the latest threat intelligence,
developing new detection and
prevention mechanisms to help business
with effective solutions to combat the
specific ransomware strain they are facing
3. Collaboration and Information Sharing:
Through active collaboration and information
sharing with relevant stakeholders,
including customers, industry peers,
law enforcement agencies, we can
foster a collaborative environment,
pool resources, share insights and
collectively respond to ransomware attacks
more effectively
4. Incident Management and Recovery:
Helping business to adopt a well-defined
incident management process in place to
handle ransomware attacks. This includes
coordinating with customers, providing
guidance on containment, facilitating
communication and helping organisations
return to normal operations as quickly
as possible, as well as ensuring regular
backups, including tests are put in place
as part of on-going process
5. Continuous Improvement: By analysing
attack patterns, post-incident reviews and
lessons learned from every ransomware
incident, we can refine better solutions
for businesses to update their procedures
and enhance their overall cyber resilience
against future attacks.
www.computingsecurity.co.uk @CSMagAndAwards July/August 2023 computing security
11