Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe
  • Twitter
  • Facebook
  • LinkedIn

Focus on the Fundamentals: 6 Steps to Defend Against Ransomware

Focus on the Fundamentals: 6 Steps to Defend Against Ransomware

Ransomware is the monetization of poor cyber hygiene. Here are 6 steps you can take to improve your security defenses.

Ransomware attacks have become a boardroom issue for nearly every organization. In 2020 alone, there were more than 300 million ransomware attacks recorded, an increase of more than 60% from 2019. There are many contributing factors to this trend, such as the steady rise in cryptocurrency, a sophisticated ransomware value-chain network and a proven business model with double extortion. However, one of the most important drivers of ransomware today is the vast number of software vulnerabilities and misconfigurations threat actors are able to feast on to gain a foothold inside organizations and propagate their attacks. 

Ransomware is dependent on attackers exploiting vulnerabilities

With work from home as the new normal, attackers are preying on remote access infrastructure and web application flaws for entry points into the network. REvil/Sodinokibi, the largest ransomware syndicate today, has increasingly targeted vulnerabilities in VPN (CVE-2019-11510), web server (CVE-2019-2725), remote desktop (CVE-2019-19781), and, just recently, remote IT management (CVE-2021-30116) infrastructure. Conti ransomware strains have also frequently targeted VPN systems and Remote Desktop Protocol (RDP) to gain access to victims' networks. Software vulnerabilities have become the fastest growing ransomware attack vector because of the sheer volume of CVEs published each year and the lack of any user interaction requirements to deploy the payload.

But it isn't just traditional CVE vulnerabilities that security teams should worry about. Misconfigurations play a huge role in ransomware propagation across the organization. Ransomware exploits have been targeting Active Directory (AD) weaknesses to escalate privileges and move laterally to higher value targets. The Ryuk ransomware group was able to propagate an attack from a single email to complete domain-wide infection in just over 24 hours using common AD misconfigurations. AD is often referred to as the "Keys to the Kingdom" because it is the center of the organization's authentication, authorization and access control. Once AD has been compromised, attackers can use AD — and its group policy attribute — to deploy ransomware to the entire enterprise.

Understanding where to shore up your ransomware defenses

There is both good news and bad news when it comes to defending against ransomware. 

First, the bad news: there is no silver bullet to protect your organization. There is no shiny Artificial Intelligence (AI)-based technology, advanced behavioral analytics or real-time detection/response solution that will magically solve this problem. Cyber defenders looking for a single ransomware point solution will be sorely disappointed. 

And, the good news: there is a path forward by focusing on the security fundamentals. I know what you're thinking: cyber hygiene isn't sexy or exciting. But it works. Fundamentals are essential to prevent successful ransomware attacks. Cyber experts such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.K. National Cyber Security Centre (NCSC) continuously stress the fundamentals, such as:

  • Conducting cybersecurity awareness training sessions to decrease phishing attacks

  • Segmenting your networks to separate various business units and resources to contain an intrusion

  • Enabling Multi-factor Authentication (MFA) everywhere

  • Maintaining frequent, encrypted backups of data and system images

  • Performing continuous Risk-based Vulnerability Management and AD assessment of your entire attack surface


6 steps for defending against ransomware 

To help you with that last fundamental, Tenable advises taking the following six steps to improve your security defenses against ransomware. 

  1. Scan often, scan everything

  2. Harden AD to protect your crown jewels

  3. De-escalate privilege escalation

  4. Prioritize using prediction

  5. Remediate like your organization depends upon it

  6. Measure to improve your game


More details on each of the above steps can be found in our handy guide, 6 Steps for Defending Against Ransomware. This resource covers best practices you can implement across the ransomware attack path to make it more difficult for attackers to gain an initial foothold and move laterally across the network. Use this guide to help turn ransomware attacks into ransomware attempts. Tenable is here to help you at each step along your journey. 

Learn More 

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

Try for Free Buy Now
Tenable.io FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.