Latest Ransomware Trends and Threats
In recent years, ransomware has continued to reign as the biggest threat in the cybersecurity field. Traditional ransomware mainly encrypts the data on infected devices and demands a ransom in exchange for recovery. However, now it is common to use double extortion,'' which not only encrypts data but also steals data in advance and threatens to release it if payment is not made.''
In addition, the methods have become more vicious, with triple threats and quadruple threats threatening to harm customers and business partners. The targets of attacks are also expanding indiscriminately, not only to large companies, but also to small and medium-sized enterprises that tend to be weak points in the supply chain, as well as organizations that have a large impact on society, such as medical institutions and infrastructure facilities, and the situation is no longer one that can be dismissed as a “fire on the other side.”
Defensive measures and responses that companies should take
A layered defense approach (defense in depth) is essential to prevent ransomware damage. First, as measures to prevent intrusions, it is necessary to manage vulnerabilities in VPN devices and remote desktops (RDP), train employees on suspicious emails, and thoroughly implement strong authentication (multi-factor authentication).
Second, it is effective to implement an Endpoint Detection and Response (EDR) solution in the unlikely event that your network is infiltrated. Suspicious behavior can be detected early and damage can be prevented from spreading. It is also important to segment the network and design it to prevent infections from spreading throughout the network.
Finally, the most reliable means of recovery is a backup. Ransomware also targets backup data on the network, so it is recommended to follow the 3-2-1 rule (3 copies, 2 different media, 1 offsite) to create immutable backups that are logically and physically separated from the network. Developing an incident response plan that assumes damage will occur is the cornerstone of modern security measures.