Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Ransomware Preparedness: Why Organizations Should Plan for Ransomware Attacks Like Disasters

Ransomware Preparedness: Why Organizations Should Plan for Ransomware Like Disasters
Ransomware Preparedness: Why Organizations Should Plan for Ransomware Like Disasters

As ransomware has cemented itself as one of the biggest cybersecurity threats to companies around the globe, it has become increasingly important that organizations treat ransomware attacks like they would a natural disaster and establish a robust preparedness plan.

Background

In 2020, Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency (CISA) called ransomware the “most visible, disruptive cyber threat” as he saw it then. Nearly two years later, Lindy Cameron, the chief executive of the National Cyber Security Centre (NCSC) in the United Kingdom calls ransomware the “biggest global cyber threat” today.

Over the last four years, CISA, NCSC and other global agencies including the FBI and the Australian Cyber Security Centre (ACSC) have issued multiple warnings about the risk of ransomware, yet it remains the most dominant threat facing organizations today.

In a recent survey of chief information security officers, nearly 70% expect to be impacted by a ransomware attack within the next year, with nearly a quarter of companies saying they were impacted by ransomware attacks on more than one occasion.

Despite the prevalence of these attacks, many organizations are not adequately prepared to respond to ransomware incidents. Organizations should ready themselves for ransomware like they do for any other emergency.

The Federal Emergency Management Agency (FEMA) in the United States has outlined the four phases of emergency management for disasters and emergencies as: mitigation, preparedness, response and recovery. This same framework can be applied to ransomware attacks.

Mitigation is the natural first step in defense

For any organization looking to defend against ransomware attacks, their primary focus should be placed on mitigation. You are likely familiar with the mitigation steps you and your organization have taken to prepare for the sorts of disasters covered by FEMA’s guidance: evacuation maps around the office in the case of a fire, maintaining insurance, battening down the hatches.

When it comes to ransomware, we know many of the tactics and techniques used by the key members in the ransomware ecosystem, from spearphishing and targeting Remote Desktop Protocol (RDP) to exploiting unpatched and zero-day vulnerabilities. Mitigation relies on identifying and securing these known attack paths, whether it’s through the use of antivirus or anti-malware and email gateways, user awareness training and vulnerability management solutions. However, even with this wealth of knowledge, organizations continue to fall victim to ransomware attacks.

Organizations should prioritize preparedness

Regardless of the emergency for which you are preparing, having a plan is critical. Most organizations likely already have incident response plans for events like natural disasters; mature organizations likely also have technology or cybersecurity focused incident response plans. As FEMA notes in one of its sample emergency management documents, it’s not just about writing the plan, but about drilling the plan and refining it.

Preparedness is an often overlooked element in the emergency management of ransomware attacks. It is not just about focusing on the various mitigation measures as a form of preparation, it is also imperative for organizations to prepare by conducting simulated attacks against their networks to test incident response plans with various stakeholders. CISA has published a variety of CISA Tabletop Exercise Packages (CTEPs) that can be the foundation for your organization’s preparedness. Walking through a simulated ransomware attack enables an organization to identify gaps in their incident response plans. Additionally, being prepared makes the various stakeholders within your organization feel confident that in the event of a real ransomware attack, the response will be measured instead of chaotic.

Response and recovery is sometimes chaotic

Response is when you put your tested plans into practice and see whether your mitigations meet their intended purpose. According to FEMA, “business and other functions do not operate normally” during these phases. The focus is on understanding and limiting the disaster’s scope of impact, shaping public perception of the incident and beginning the process of returning to “business as usual.”

How an organization responds to a ransomware attack has become more important over the last few years, as ransomware groups not only encrypt files within a company’s network, but also exfiltrate and threaten to publish these files on leak websites hosted on the dark web. This tactic creates a sense of urgency, as ransomware groups provide little time for negotiations. So while an organization is tasked with trying to recover from an attack and restore network operations, they also face the added pressure of reputational harm from the leak of confidential information.

Because of the public nature of leak websites and the ardent tracking by reporters, ransomware response is often done in the public eye. This means that response operations are not limited to security and IT teams. Teams including customer support, legal, public relations and investor relations may all end up involved in the response. Those groups should also be part of preparedness efforts.

A challenge when responding to a ransomware attack is that organizations must negotiate with individuals or groups that weren’t responsible for attacking them. In the ransomware ecosystem, third parties such as ransomware affiliates and initial access brokers are the ones gaining a foothold within an organization before selling that access or partnering with ransomware groups directly. This distributed involvement can complicate negotiations and the investigations necessary for recovery.

Several moving parts are involved in the response and recovery process, but organizations don’t need to operate from a reactive position. They can be proactive through preparedness.

A global preparedness initiative is needed

In the United States, the Department of Homeland Security’s ready.gov resource provides low cost and free preparedness guides. We believe a similar resource should be created for ransomware preparedness and made available for organizations around the world, since ransomware is a global threat, as the NCSC’s Cameron has pointed out.

Steps you can take right now to be more prepared

  • Review your incident response plans (or start developing one) and confirm it’s sufficient to address a ransomware attack.
  • Conduct tabletop exercises with various stakeholders within your organization at least once a year if not more often.
  • Cut off known attack vectors by patching known, exploited vulnerabilities and addressing Active Directory misconfigurations. Tenable Research has produced scan templates and dashboards for Tenable.io, Tenable.sc and Nessus that can help identify known vulnerabilities used by ransomware affiliates and IABs.
  • Establish visibility for your organization’s full attack surface and how attackers may seek to breach your defenses.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web Application Scanning trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.cs Cloud Security.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable.io Container Security

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try Tenable Lumin

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable.io Vulnerability Management, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable.cs

Enjoy full access to detect and fix cloud infrastructure misconfigurations and view runtime vulnerabilities. Sign up for your free trial now.

Your Tenable.cs Cloud Security trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.io Web Application Scanning.

Contact a Sales Rep to Buy Tenable.cs

Contact a Sales Representative to learn more about Tenable.cs Cloud Security and see how easy it is to onboard your cloud accounts and get visibility into both cloud misconfigurations and vulnerabilities within minutes.

Try Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Promotional pricing ends September 30th.
Buy a multi-year license and save more.

Add Support and Training