Cambodia CERT Seminar: Incident response for ransomeware attacks

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

1
Incident Response for Ransomware
Attacks
Adli Wahid
Security Internet Security Specialist, APNIC
adli@apnic.net

2
Let’s Connect!
• LinkedIn: Adli Wahid
• Twitter / Instagram : @adliwahid
• Email: adli@apnic.net

3
APNIC
• Regional Internet Registry in the AP Region
• Delegate IP addresses & ASN
• Host services – whois db, RPKI
• Com...

4
Ransomware
• Extortion – pay money
o To get data back (decrypted)
o To safeguard data from being published
• Malware
o O...

5
Ransomware
• Business Model – Criminal
o Developer
o Operator
o Partners / Contractors
• Targeted
– Enterprises, SMEs an...

6
Incident Response & Handling
• Understand the Threat & Break It Down
o What is the ultimate goal – profit (?)
o How do a...

7
Ransomware
Attack Life
Cycle

8
https://www.cert.govt.nz/it-specialists/guides/how-ransomware-happens-and-how-to-stop-it/

9
Possible Entry-points
• “Attack Surface”
• Get Valid Credentials
(username/passwords)
– Phishing
– Guessing / Bruteforce...

10
2nd Stage
• Few possible activities
• Connect to ”Command and Control” /
Controller
o Report / Provide details
o Find (...

11
3rd Stage
• Achieving Ultimate Objective
• Data Exfiltration
– Copying data out
• Destroy backups
• Encrypt Data
– Send...

12
To Note!
• From starting to end
– This may take time depending on complexity
– Attacker is in your environment
• You st...

13
Critical
Controls

15
Critical Controls
o Hardened Internet Exposed Services
o Backups
o Patch Management
o Multi-factor Authentication
o Net...

16
Controls for Initial Access
Logging and Alerting
Internet Exposed Services
Multi-factor Authentication
Password Manager...

17
Quick Discussion
• Logging and Alerting – Detection
– Centralized Logging (ElasticSearch or Splunk)
– Wazuh*
• Password...

19
Quick Discussion (stage 1)
• Internet Exposed Service
– Access Control
– Are they needed ? (i.e. RDP), use VPN
– Scan o...

20
Shodan.io – port:3389 country:KH

21
Yoursebsite.domain
Web shell installed in webserver

22
Windows Honeypot – SMB is very popular

23
Controls for Stage 2
Logging and Alerting
Network Segmentation
Multi-factor Authentication
Principle of Least Privilege...

24
Quick Discussion (Stage 2)
• Logging and Alerting
– Attempts to login (success and fail)
– Honeypots
o Setup decoy syst...

25
Security Events – Wazuh (with Elasticsearch / Kibana)

27
Modification made to /etc/hosts (FIM module)

29
Diff – report_changes=“yes”

30
Controls for Stage 3
Logging and Alerting
Application Allowlisting
Backup

31
Discussion
• Data Exfiltration
– Maybe a lot of data
– How to get data out? http? ssh
– Policy for outbound traffic, mo...

32
What if you’re hit!
1. Don’t Panic
2. Isolate system from further infection
3. Identify Ransomware
o https://www.nomore...

34
Increasing Preparedness
• Setup controls discussed before
• Training for internal staff
– Understand the threats
– Help...

35
Summary
1. Ransomware is a serious threat
2. We need to understand how it works
3. We have to apply appropriate (basic)...

36
https://wwww.unsplash.com/adliwahid
Thank You!
adli@apnic.ne
t
www.apnic.ne
t

37
References
1. https://www.cert.govt.nz/assets/ransomware/cert-
lifecycle-of-a-ransomware-incident.pdf

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 545284 views
Storytelling For The Web: Integrate... by Chiara Aliotta 433420 views
Artificial Intelligence, Data and C... by OECD Directorate ... 308718 views
How to Leverage AI to Boost Employe... by SocialHRCamp 133046 views
2024 State of Marketing Report – by... by Marius Sescu 113176 views
Everything You Need To Know About C... by Expeed Software 149056 views

Top clipped slide

View on SlideShare

1 of 37 Ad

1 of 37 Ad