With ransomware on the rise, executives have many questions on their minds. What do I need to know about ransomware? To what extent is ransomware covered by cyber insurance? And most importantly, what can be done to prevent these attacks from happening in the first place?

At Ignite Conference 2016, Gus Coldebella of Fish & Richardson, Erin Nealy Cox of Stroz Friedberg and Sean Duca of Palo Alto Networks provided a C-level view of the latest attack vectors. Watch what this panel of experts had to say about the rise of ransomware in this short video now on Security Roundtable:

Page URL: https://www.securityroundtable.org/what-the-c-suite-needs-to-know-about-the-rise-of-ransomware

Subscribe to Security Roundtable to stay updated on best practices, use cases and expert advice for executives navigating cybersecurity risks.

Cristina Salmastlian

[Palo Alto Networks Research Center]

If 2015 was the year of the healthcare breach, 2016 is shaping up to be the year of ransomware.

By this time last year, 105 healthcare breaches had been reported to the U.S. Department of Health and Human Services (HHS) for a total of over 92 million lost records, compared to “only” 81 breaches and 3.5 million records so far in 2016. Good news, right? Well, sort of.

Unfortunately, this seemingly positive trend does not reflect the actual threat landscape in the healthcare industry. Healthcare organizations subject to HIPAA only need to report breaches to HHS if 500 or more patient records are exposed. Many types of cyberattacks on hospitals, like ransomware, impact systems and possibly patient care, but do not result in breached records and hence are not reported to HHS (although there are currently opposing views on whether a ransomware attack should be reportable under HIPAA).

Ransomware is a type of malware that restricts access to files or systems with encryption until the victim (the hospital) pays the ransom for the key to unlock them. In a previous post I outlinedhow hospitals can track down the infected PC when an infected PC somewhere on the network encrypts the contents of an entire department shared drive.

As a former security operations lead for a hospital network, I responded to numerous ransomware infections firsthand as a result of targeted phishing campaigns against the hospital. The incident response team followed the same procedure for each incident: isolate the infected PC and restore the corrupted (encrypted) files on the department shared drive from backup. In such isolated instances, there was no impact to clinical operations and patient care. However, the story would have been different in the case of widespread infection on the network.

Several healthcare providers in Washington, California and Kentucky were publically impacted in 2016 by what appears to be widespread ransomware infection across many different devices in a short amount of time.

Prevent and Minimize the Impact of Ransomware

There are many things that your healthcare organization should be doing to minimize the impact of successful ransomware attacks. Here are a few tips to get you started:

Effectiveness	Mitigation Type	Activity
High	Minimize Impact	Develop and execute a plan for an end user awareness program Yes, I know it’s difficult to get approval to send regular hospital-wide security advisories, but smarter end users will surely result in fewer ransomware incidents.
High	Minimize Impact	Review / Validate Server Backup Processes Some organizations don’t realize their backups are compromised or were configured improperly until it’s too late.  You may need them to restore service. Start with your File Servers that host network shares for critical hospital departments Ensure you have backups that are not accessible by end users – ideally off-site.  Backup administrator roles should be assigned sparingly, used sparingly and regularly audited. Test your backups regularly to validate they can be restored properly.
Medium	Minimize Impact	Review network drive permissions to minimize the impact that a single user can haveEnd User Privilege Reviews Assign a project manager to organize an effort to evaluate permissions that users have on mapped network drives. Implement the principle of least privilege to minimize the impact that any single user can have on the organization’s network shared drives.  This process could turn into a large, complex effort, so start with network drive locations used by critical departments (Emergency, Organ Transplant etc). Administrator User Privilege Reviews Audit privileged roles used by the Server, Backup & Network Teams to validate appropriate access. Ensure administrators are assigned normal restricted accounts, separate from their highly privileged accounts. Require administrators to only use their highly privileged accounts when they need them. Remove automatic network drive mappings from administrative accounts, where possible. Restrict administrative accounts from receiving email.
High	Prevention	Disable macro scripts from MS Office files using AD Group Policy According to Microsoft, 98% of Office-targeted threats use macros. Disabling macro scripts from MS Office files will stop ransomware such as Locky. Office macros are usually not required for the majority of PCs used in healthcare environments. Enable macros for exceptions or certain departments only.
High	Prevention	Review your monthly patch management processes Many hospitals struggle to patch their systems within 30 days of Microsoft’s “Patch Tuesday” monthly patch release.   Review your patching processes and look for opportunities to remove roadblocks. Consider deploying an advanced endpoint product that prevents exploits due to missing patches and malware.
Medium	Prevention	Evaluate your inbound spam / malware protection Ensure you are configured to block inbound mail as per recommendations from your email server vendor (i.e. block executables in attachments etc)
High	Prevention	Deploy a next-generation firewall to protect the hospital network Ensure your firewall automatically blocks known threats based on a threat feed that constantly updates. Ensure your firewall provides sandboxing capabilities so you can stop unknown threats (URLs and executables) before they reach the endpoint. Sandboxing is the best way to detect new variants of ransomware that constantly appearing in the wild. Configure your firewall/proxy to require user interaction for hospital end users communicating with websites uncategorized by the network proxy or firewall (i.e. click a “proceed” button). Many uncategorized websites are used in targeted phishing campaigns to distribute malware.
High	Prevention	Deploy advanced endpoint protection to protect the endpoint Traditional antivirus is not effective anymore against advanced malware like ransomware which continuously changes to avoid detection. Your endpoints need advanced protection capable of stopping processes that exhibit malicious behavior, rather than checking for individual known bad files.   Whitelisting can work for some organizations but most hospitals need to permit hundreds of applications across their departments so it is often difficult for IT to manage the list.Behavior-based malware detection tends to be very effective, and also lightweight on the endpoint.

These suggestions range from low-tech to high-tech and vary in cost, but all contribute to create a hospital environment that is highly resistant to ransomware with the least amount of manual management. Decide for yourself which combination of mitigating activities is best for your environment.

If you want to read more about the history of ransomware – take a look at The Rise of Ransomware, a recent paper from our threat intelligence team, Unit 42.

Matt Mellen

[Palo Alto Networks Research Center]

There has been much media coverage of ransomware over the past several months. The healthcare industry has been in this spotlight most recently, but financial services is certainly not immune to this threat. Back in mid-2014, a U.S. brokerage house fell victim to CryptoWall, which both encrypted and exfiltrated data from that institution. Although there have not been many public disclosures of ransomware incidents at financial institutions as of late, CryptoWall ransomware was one of the top 3 threats to the industry in both 2014 and 2015 based on research by Unit 42, the Palo Alto Networks threat intelligence team. In late 2015, the U.S. Federal Financial Institutions Examination Council (FFIEC) and the Financial Services Sector Coordinating Council (FSSCC) issued separate alerts on cyber extortion and destructive malware, respectively. So it’s clear that the financial services industry needs to be prepared to address such malicious attacks.

Ransomware is essentially malware that encrypts data on personal computers and network drives until a payment made to the perpetrator. The ransom demanded is usually a small monetary amount to increase the likelihood of payment. Ultimately, this may boil down to a business decision over the time and effort required to restore files from back-ups versus the cost of the ransom to obtain the decryption key from the attacker. For more details about the evolution of ransomware, please see the new report on ransomware trends from Unit 42.

To protect themselves from the impact of ransomware, financial institutions should conduct regular back-ups of data on PCs, shared drives, and any other storage systems. Moreover, the data on the back-up system needs to be verified to ensure there are no surprises when restorations are warranted. This should already be a recurring practice as part of business continuity plans, but it’s worthwhile to validate this since viable back-ups are integral to any ransomware remediation actions.

Preventing infection by ransomware is an even better course of action. It eliminates lost productivity and impact to business operations, as well as the overhead associated with removing the malware and restoring the encrypted data files. By establishing defenses at multiple layers of the network, the following steps will significantly improve an institution’s ability to prevent ransomware attacks from being widely successful.

• Scan and block suspicious files (e.g., portable executables) in all inbound e-mail or web-browsing sessions
• Prevent the ingress of malware by using intrusion prevention systems (IPS) for known threats and sandbox analysis for zero-day threats
• Block outbound traffic to malicious URLs or sites, which may be part of the attack lifecycle for ransomware
• Prevent exploits and malware execution on PCs and servers with endpoint protection capabilities above and beyond anti-virus and host IPS
• Contain any threats by segmenting the internal network to limit lateral movement and to minimize the fault domain

The Palo Alto Networks Next-Generation Security Platform offers a multi-layered approach to prevent ransomware from infecting financial services institutions. These capabilities can be part of an overall defense plan against ransomware. To learn more about how this works, visit our Financial Services resource page.

Lawrence Chin

[Palo Alto Networks Research Center]

In the first blog of this series we reviewed perceptions and current states of preparation for the EU legislative changes and how they impact your cyber security strategies, drawing on information that was collected during the registration process for a webinar run for practitioners with ISACA.

News Flash: On May 4, 2016, the European Union (EU)’s General Data Protection Regulation (GDPR) was published in the Official Journal of the EU.  The regulation will enter into force 20 days after its publication, on May 25, 2016.  Its provisions will be directly applicable in all member states two years after this date, so companies will need to comply with the GDPR as of May 25, 2018.

The GDPR will replace the 1996 Data Protection Directive.  The GDPR is a complex piece of legislation, with many different requirements, and coming into compliance with them all by the May 25, 2018 deadline will take extensive work for companies around the world that handle the personal data of EU residents. 

In this second blog, we will examine three further questions that we asked live. You should note that many listen to such sessions in the post-recording, so the sample set in the live polls was 300+, but I would suggest this still gives us a very valuable sample of perceptions.

Obviously any new legislation being implemented is done with noble intent. In these instances, the way in which we use and depend on the Internet has evolved: there is a desire to drive confidence in society as our digital world grows. It was therefore good to see that 74 percent of respondents saw the General Data Protection Regulation (GDPR) and the Network and Information Security Directive (NIS Directive) as raising the bar for cybersecurity, compared to their current capabilities. Nine percent felt that existing security regulations in their industry were already higher, which I would suggest is most likely organizations in the financial services space. But what we should consider is that the bigger the gap between where organizations are today and the needed requirements, the more time and budget will be required to achieve compliance. As such, one of the first tasks for any organization should be to complete the gap analysis to validate the scope of work ahead and, importantly, to get the right executive sponsorship behind the project.

The second poll looked at just what the gap analysis was. Nearly half (44 percent) suggested they have significant work ahead. There are both positives and negatives here. There is an indication that analysis has been done, but only 14 percent suggested they had a managed project already underway. A concerning 36 percent suggested they had no idea of the effort required or were not planning to start focusing on becoming compliant until the legislation goes live.

This highlights some very differing perceptions on legislation across the EU and different industry groups. But with harmonization being a key driver for the EU, I would anticipate that, in years to come, the diversity of answers would reduce.

As a security leader, it is critical to ensure that the decision to achieve compliance should be made collaboratively, which means engaging the legal team, business leaders and the cybersecurity team to make an informed decision on what the right next steps are for the business to take. It’s easy to simply state that this is a “must”, but for each business there must be a review in terms of gap analysis, costs of compliance, ownership and investment strategy. For some, the timescales and investment required may already be too constrictive.

The final poll validated as much, with only 35 percent of respondents confident in their company’s ability to adhere to the 2018 deadline. Thirty-six percent already considered the timescales to be tight, and 14 percent suggested they didn’t expect to make the go-live date. Of note was the 15 percent that are still waiting on timelines to be finalized, to which I would suggest that these are now sufficiently well-defined. We should not be waiting to act, but for many legislation can be a complex quagmire. That is why organizations must engage with their legal teams and ensure they either get educated or remain informed about these legislations and how they impact cyber strategies.

Hopefully the insight from your peers gives you confidence that you are in line with others on your journey in adhering to the upcoming requirements. If you are not, may that insight help you gain the business support you need to validate the importance of catching up with your peers.

So what next? I would suggest you consider the following key steps in your action plan:

1. If you haven’t already, start preparing now!

2. Stay informed. Palo Alto Networks will continue to provide you with updates on what this means for you and your cyber strategies on our microsite:http://go.paloaltonetworks.com/regulation.

3. Assign executive ownership.

4. Complete a gap assessment: Can you qualify your risk today and do you have the relevant regard for ”State of the Art”?
– Work with your auditor/advisors to have a clearly defined risk assessment.

5. Ensure you have legal and privacy guidance (internal/eternal) to validate that you have the right understanding of the legislation for your business.

6. Define a plan to get adopt and maintain relevant regard for “State of the Art”.

7. Make a clear plan on how you will deal with incidents, as they will happen.

8. Ensure you have a made conscious decisions on how you balance your investments, between prevention and detection (“State of the Art”) and responsive capabilities.

Greg Day

[Palo Alto Networks Research Center]