Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Defend Yourself
& Your Agency
Against Ransomware
• What is Ransomware?
• How does it affect you?
• Real world example
• What to do if you are a victim of
Ransomware?
• Gen...
What is Ransomware?
Ransomware is a type of malicious software that restricts
access to a victim’s infected computer while...
ü Prevent you from accessing your operating system
ü Encrypt all of your files
ü Prevent you from running an application (...
• Payment is always the goal of the attackers
• …..(but restoring access to a computer
once the payment has been made is n...
Reason #1:
Ease of use
Reason #2:
Propagation of Bitcoins
(an increasingly common type of internet currency that is
often ...
Source: https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx
Ransomware Comes in Many Forms:
2016 Ransomware Highlights
Source: https://www.trendmicro.com/vinfo/us/security/definition/ransomware
Attackers can restrict access to an infected
computer
How?
By…
• Encrypting the hard drive with a
encryption key known onl...
Real World Example
Target Spotlight:
Large Hospitals
• Recently, large urban hospitals have
been targets of ransomware...
• March 2016: Hollywood Presbyterian
Hospital in Los ...
Real World Example
Ransomware Spotlight:
CryptoLocker
How was it made?
• This ransomware was propagated using malicious email
attachments. It also used an existing botnet calle...
Why was it hard to recover encrypted data?
• The private key that could decrypt the data was stored on the
botnet’s comman...
How was it beaten?
• The original version of CryptoLocker was taken down when an
international operation consisting of law...
Keep an eye out
• ...Updated versions of CryptoLocker and many other forms of
ransomware have now become popular amongst c...
What if YOU Were the Victim?
If your computer has been locked by
malware or the files have been encrypted…
What if YOU Were the Victim?
Step 1:
Don’t click on ANYTHING!
What if YOU Were the Victim?
Step 2:
Don’t believe scare tactics!
Older versions of ransomware would often claim that you
...
What if YOU Were the Victim?
Step 3:
If at all possible, don’t pay the ransom!
The fewer people and organizations that pay...
Option 1:
• If you feel you are technically savvy, you can visit Microsoft’s
website for steps that might help decrypt you...
General Security Tips:
Implementing a multiple layer of defense technique is required to
defend computers against the crip...
What to Know About Malicious Software Detection Tools
ü**Keep in Mind**...While these tools are useful, they may
not be ab...
üThis is the MOST IMPORTANT layer
of defense.
üIt is important to have a data
backup policy where system
backups are store...
Additional Resources
• Get your free Ransomware Toolkit
• Learn more about our Security Awareness Training
Program
• Check...
Upcoming SlideShare
Loading in …5
×
Upcoming SlideShare
Security Best Practices for Regular Users
Next
Download to read offline and view in fullscreen.

1

Share

Download to read offline

Get Smart about Ransomware: Protect Yourself and Organization

Download to read offline

As ransomware threats continue to rise, it's important to understand how to protect yourself and your organization against these cyberattacks and what you should do if you become a victim.

Related Books

Free with a 30 day trial from Scribd

See all

Get Smart about Ransomware: Protect Yourself and Organization

  1. 1. Defend Yourself & Your Agency Against Ransomware
  2. 2. • What is Ransomware? • How does it affect you? • Real world example • What to do if you are a victim of Ransomware? • General Security Best Tips Agenda
  3. 3. What is Ransomware? Ransomware is a type of malicious software that restricts access to a victim’s infected computer while demanding that the victim pay money to the operators of the malicious software before that software is removed and access is regained.
  4. 4. ü Prevent you from accessing your operating system ü Encrypt all of your files ü Prevent you from running an application (like a browser) ü Disrupt your use of a smart TV, smart watch, or other smart appliances Once one of the above happens, there is no guarantee that paying the demanded ransom will restore your machine back to normal. Ransomware CAN:
  5. 5. • Payment is always the goal of the attackers • …..(but restoring access to a computer once the payment has been made is not always possible) • The return on investment for the attackers is very high with this type of attack. What is the Goal of the Attacks? PAYMENT!
  6. 6. Reason #1: Ease of use Reason #2: Propagation of Bitcoins (an increasingly common type of internet currency that is often demanded as ransom due to its untraceable nature) Reason #3: Often, the ransom the attackers demand to clean up the damage is cheaper than hiring a security team to attempt to remove the malware. Why Has it Become so Popular?
  7. 7. Source: https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx Ransomware Comes in Many Forms:
  8. 8. 2016 Ransomware Highlights Source: https://www.trendmicro.com/vinfo/us/security/definition/ransomware
  9. 9. Attackers can restrict access to an infected computer How? By… • Encrypting the hard drive with a encryption key known only to the attackers • Taking control of the operating system using a vulnerability present in the operating system and then displaying a message to the user telling them they have been locked out How Does it Affect YOU?
  10. 10. Real World Example Target Spotlight: Large Hospitals
  11. 11. • Recently, large urban hospitals have been targets of ransomware... • March 2016: Hollywood Presbyterian Hospital in Los Angeles paid $17,000 to regain access to its computers • March 2016: The largest healthcare provider in Washington DC, MedStar Health, was ransomed for over $18,000 to gain access to its systems. • This form of extortion can be painful to organization not only for the monetary loss, but also due to loss of reputation as their company names are made public) Target Spotlight: Large Hospitals
  12. 12. Real World Example Ransomware Spotlight: CryptoLocker
  13. 13. How was it made? • This ransomware was propagated using malicious email attachments. It also used an existing botnet called “Zeus” for command and control of the malicious software. What did it do? • CryptoLocker would encrypt certain types of files that were stored locally or on mounted network drives using a public encryption key. CryptoLocker targeted computers running Windows. Ransomware Spotlight: CryptoLocker
  14. 14. Why was it hard to recover encrypted data? • The private key that could decrypt the data was stored on the botnet’s command and control servers. The malware was easy to remove…but that wasn’t the point. Once the data was encrypted, the damage was done. What was the ransom threat? • Then the private key needed to decrypt their data would be deleted…or the ransom would increase by a significant amount Ransomware Spotlight: CryptoLocker
  15. 15. How was it beaten? • The original version of CryptoLocker was taken down when an international operation consisting of law enforcement agencies, security companies, and academic researchers was able to destroy the ZeuS botnet which had been used to propagate CryptoLocker. • “Operation Tovar” was able to sever the ZeuS botnet from its “command-and-control” servers. These servers had been used to send commands to machines infected with CryptoLocker and other forms of malware. • Security firms were then able to create a portal called “Decrypt CryptoLocker”, which enabled over 500,000 victims to submit a file encrypted by CryptoLocker. The portal would then test that file against all of the encryption keys that had been stored by the command-and-control servers to find the one that would decrypt the victim’s files. Ransomware Spotlight: CryptoLocker
  16. 16. Keep an eye out • ...Updated versions of CryptoLocker and many other forms of ransomware have now become popular amongst cyber criminals, so the threat still remains. Ransomware Spotlight: CryptoLocker
  17. 17. What if YOU Were the Victim? If your computer has been locked by malware or the files have been encrypted…
  18. 18. What if YOU Were the Victim? Step 1: Don’t click on ANYTHING!
  19. 19. What if YOU Were the Victim? Step 2: Don’t believe scare tactics! Older versions of ransomware would often claim that you had done something illegal with your computer. This is a scare tactic to trick victims into paying the ransom and not alerting the authorities. …Don’t believe it!
  20. 20. What if YOU Were the Victim? Step 3: If at all possible, don’t pay the ransom! The fewer people and organizations that pay, the less likely That ransomware will stay as profitable as it is now.
  21. 21. Option 1: • If you feel you are technically savvy, you can visit Microsoft’s website for steps that might help decrypt your files. Option 2: • If you don’t feel comfortable trying that, we recommend taking your computer to a well known computer repair shop that has experience with removing ransomware and restoring files.
  22. 22. General Security Tips: Implementing a multiple layer of defense technique is required to defend computers against the crippling effects of ransomware. Recommendation? Implement User Education Train your staff in security awareness best practices, especially email and malware!
  23. 23. What to Know About Malicious Software Detection Tools ü**Keep in Mind**...While these tools are useful, they may not be able to stop the most recent versions of this malicious software because they are only able to identify the versions of the malicious software they recognize üKeep all of your software up to date, especially your browsers üIf possible, have a pop-up blocker running on your browsers General Security Tips:
  24. 24. üThis is the MOST IMPORTANT layer of defense. üIt is important to have a data backup policy where system backups are stored in a location that is inaccessible to the infected machine, preventing the ransomware from encrypting the backups. üThe backups should be stored on removable media or a drive that wasn’t connected when the ransomware was installed and executed. General Security Tips: Maintain a Consistent Back-Up Data Policy
  25. 25. Additional Resources • Get your free Ransomware Toolkit • Learn more about our Security Awareness Training Program • Check out our blog for more security awareness tips
  • JohnPTralongo

    Oct. 23, 2016

As ransomware threats continue to rise, it's important to understand how to protect yourself and your organization against these cyberattacks and what you should do if you become a victim.

Views

Total views

474

On Slideshare

0

From embeds

0

Number of embeds

3

Actions

Downloads

23

Shares

0

Comments

0

Likes

1

×