This time of year, causes me to think about cyber lessons learned, malware related questions from customers and colleagues and all the ghoulish activities we have witnessed in 2017. We have seen obvious phishing mails that are clearly spoofed email addresses or URL’s and have provocative messages to drive users to click. These provoke the users to click the message, open an attachment or a click infected URL that cause the execution of the malware. Another common way to be become infected is through compromised websites that can trigger the installation of an unintentional program download.  These are “Tricks” used to cause a user to change their normal behaviors. As we have more and more awareness of Phishing and Ransomware, our ability to be “Tricked” has been reduced, but not eliminated.

Ransomware has now become synonymous with Phishing. The two attack types are merged together into an embedded encryption attack. The statistics are showing that over 90% of all Phishing attacks now contain Ransomware encryption. The technique of the Phishing mails is changing in the business world to draw employees in and cause the attack to be successful. The emails that are now seen include a personalized message with a correct salutation that includes subjects of interest by job category. These are effective attacks and are gaining popularity. Sophistication of social engineering is improving in these types of attacks, while the skilled and resources required by an attacker execute them has diminished rapidly Any criminal can leverage ‘ransomware as a service’ on the dark web and inflict serious damage along with potentially huge financial gains.

Ransomware is also getting in to business systems through the vulnerability of operating systems and software. Targeted attacks are being delivered on outdated security software or system software. These types of attacks are broad and successful as we have seen over the past few months. The Malware enters the organization via targeted attacks of known vulnerabilities and they migrate through systems to infect the entire network and its connected devices.

Ransomware works in a very orchestrated manner. Once the ransomware program has been executed it starts communicating with its host to acquire an encryption key. This happens very quickly. Once the program has its key it encrypts the data on a system. The data is then unusable. Encrypted data can “typically” be recovered using the decryption key, but there are no guarantees given the source of the attack. Once the decryption key is delivered back to the program, the process can then be reversed.

The best preparation an organization can take is to follow common best practices. From updating end-point protection products, to implementing stringent data back-up procedures to patching and updating of software, best practices are not difficult in themselves, but require commitment and focus. These along with a cybersecurity process of Identify, Protect, Detect, Respond and Recover are extremely valuable for any business. Phishing/Ransomware Employee education and training continues to be a highly valuable process to do on a continual basis.

In addition to developing a Cybersecurity process and following a standardized framework, vulnerability scanning and monitoring network behavior are must have proactive countermeasures.

Lastly, nothing is guaranteed to keep your business safe, but, reducing your attack surface area will be worth the investment. The ability to know in real-time if an attack is in process and the knowledge to remediate or immediately take the suspect system off-line, can save you significant time, energy and money, the real “treats” of this Halloween season.