Satisnet Ltd, Basepoint Innovation Centre, 110 Butterfield Great Marlings, Luton, Bedfordshire, LU2 8DL enquiry@satisnet.co.uk
+44 (0) 1582 434320

Useful Steps To Avoid The Ransomware Attacks Within A Production Environment

Useful Steps To Avoid The Ransomware Attacks Within A Production Environment

Useful Steps To Avoid The Ransomware Attacks Within A Production Environment

Below are some simple steps suggested by one of the leading cyber-security firms to escape ransomware attacks:

  • Always keep your security software up to date as new ransomware variants appear on a regular basis
  • Software updates will frequently include patches for newly discovered security vulnerabilities so keep operating system and other software updated
  • Email is one of the main infection methods. Be wary of unexpected emails especially if they contain links and/or attachments
  • Be extremely wary of any Microsoft Office email attachment that advises you to enable macros to view its content. Unless you are absolutely sure that this is a genuine email from a trusted source, do not enable macros and instead immediately delete the email
  • Backing up important data is the single most effective way of combating ransomware infection. Back-ups should be appropriately protected or stored off-line so that attackers can’t delete them
  • Using cloud services could help mitigate ransomware infection, since many retain previous versions of files, allowing you to “roll back” to the unencrypted form

Suggested practices to prevent ransomware attacks:

  • Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline
  • Be careful before opening unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organisation's website directly through browser
  • Don’t allow PowerShell /WSCRIPT in enterprise environment Ensure installation and use of the latest version (currently v5.0) of PowerShell, with enhanced logging enabled. Script block logging, and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis
  • Use web and email filters on the network. Have a proper configurations for these devices to scan for known bad domains, sources, and addresses; block these before receiving and downloading messages. Scan all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution
  • Don’t forget to disable macros in Microsoft Office products. Some Office products allow for the disabling of macros that originate from outside of an organization and can provide a hybrid approach when the organization depends on the legitimate use of macros. For Windows, specific settings can block macros originating from the Internet from running
  • Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares
  • Create a Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes
  • Maintain updated Antivirus software on all systems
  • Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools
  • Block the following types of the attachments: exe | pif | tmp | url | vb | vbe | scr | reg | cer | pst | cmd | com | bat | dll | dat | hlp | hta | js | wsf
  • Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements,(backdoors /malicious scripts.)
  • Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA%, %PROGRAMDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations. Enforce application whitelisting on all endpoint workstations
  • Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches
  • Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls
  • Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks
  • Disable remote Desktop Connections, employ least-privileged accounts

References: http://www.thehindu.com/sci-tech/technology/internet/steps-to-escape-a-r...