It’s every security pro’s nightmare: Your company has been hit with ransomware, and every machine and server has been encrypted.
Shocked? Likely, but security experts say the warning signs were there all along. Misdirected DNS requests, bad VPN reboots, and Active Directory login failures should have been setting off alarms that a ransomware attack was in progress.
It doesn’t have to be this way. According to Tarik Saleh, a senior security engineer and malware researcher at DomainTools, mitigation efforts begin with evaluating how vulnerable your company is to exploits. For example, are you leaving databases exposed on the public Internet?
“You first have to ask yourself how your business stands in the eyes of the attackers,” Saleh says.
And once attackers are in your network, you have anywhere from 48 hours to 12 days before they pull the trigger, says Mike Hamilton, CISO of CI Security.
What key warning signs should you or your IT services provider be on the lookout for as you develop a ransomware mitigation plan?
Watch out for these signs:
- If your business uses Microsoft Active Directory Services (AD/DS), Active Directory will show multiple login failures.
- Brute force login attacks will hit your network. Make sure your identity management system can notify you of these attempts.
- You’ll receive phishing emails with strange domains that you’ve never seen before.
- Your network or intrusion detection system (IDS) starts to complain about one machine in particular. This is often the beachhead for an attack.
- Security tools are showing up on systems that they weren’t assigned to. Once systems are hacked, hackers often employ their own security tools to try and understand your network better.
- If you use VPN to connect to your office systems, watch out for strange timestamps. If hackers compromise one of your systems, they may suddenly be traffic spikes that are off-hours for North America but are regular working hours in Russia.
- Watch out for DNS traffic that are going to weird locations. (Read our article on DNS Firewalls to learn more).
For more information on this topic, visit DarkReading’s article.
0 Comments