How to recover from ransomware 2017

•

0 likes•261 views

Ransomware is the biggest cyber and continuity risk in 2017. It’s not just the NHS and small businesses – everyone is vulnerable. We’re even seeing global enterprises with big security investments and dedicated security teams get infected. Importantly, you have more options than to either pay the ransom or lose your data. It’s possible to recover without any significant data loss, zero downtime and in some circumstances – without your users even knowing there was a problem. How ransomware works and why it is breaching organisational defences The best methods for prevention The Incident and crisis management and escalation process A step-by-step guide to recovery

Technology

www.databarracks.com | 2www.databarracks.com | 2
INTRO &
AGENDA
Duration: 30 mins
(including Q&A)
Type questions on
the right
Q
• What it is and how it works
– How ransomware works and why it is breaching
organisational defences.
• Prevention & mitigation
– Methods
– The Incident and crisis management &
escalation process
• Recovery
– A step-by-step guide to recovery
*Slides will be made available and sent out following this session

www.databarracks.com | 3www.databarracks.com | 3
WHAT IS
RANSOMWARE
AND HOW
DOES IT
WORK?

www.databarracks.com | 4www.databarracks.com | 4
KEY FACTS
• The encryption is to all intents unbreakable so
backup data copies are the only guarantee to
limit data loss
• There is a deadline for payment – which forces
action –recovery or payment

www.databarracks.com | 5www.databarracks.com | 5
WANNACRY
• How it spreads
– Installed by a worm
– Uses Eternalblueexploit for
Server Message Block (SMB)
• US$300 ransom in bitcoins
• Ransom doubled after 3 days
• Files deleted after 7 days
What’s different?What’s the same?

www.databarracks.com | 6www.databarracks.com | 6
HOW MANY
DATABARRACKS
CUSTOMERS
WERE AFFECTED?
1

www.databarracks.com | 7
WHO IS BEING TARGETED AND WHY IS IT SO
SUCCESSFUL?
Why? Who?

www.databarracks.com | 8www.databarracks.com | 8
HOW DOES RANSOMWARE WORK -
BACKGROUND

www.databarracks.com | 9www.databarracks.com | 9
HOW DOES RANSOMWARE WORK -
BACKGROUND
Installation Contact with
command and
control
Search Encryption Ransom

www.databarracks.com | 10www.databarracks.com | 10
INCIDENT RESPONSE AND CRISIS
MANAGEMENT ESCALATION
Preparation Identification Containment Eradication Recovery
Lessons
learned
Creatinga written
policy and defining
severity
Identifyingwhether
somethingis, or is
notan incident
The steps to limit
the spread of
ransomware
Restorationof clean
data from before the
incident
Bringingthe
recoveredsystems
back online
How do we improve?

www.databarracks.com | 11www.databarracks.com | 11
HOW TO RECOVER
vs
Backup Disaster recovery

www.databarracks.com | 12www.databarracks.com | 12
HOW TO RECOVER
• Increase the frequency of
backups
• Review (and extend) retention
policies
• Optimise connection speed
between target and recovery
environment (general)
• Improvespeed of finding most
recent clean backup
Improving the Recovery Point
Objective
Improving the Recovery Time
Objective

www.databarracks.com | 13www.databarracks.com | 13
RECOVERY
Time to recover:
1 restore
24 hour RPO
3 days

www.databarracks.com | 14www.databarracks.com | 14
RECOVERY
Time to recover:
1-2 restores
12 hour RPO
2.5 days

www.databarracks.com | 15www.databarracks.com | 15
RECOVERY
Time to recover:
4-6 restores
4 hour RPO
2 days 4 hours

www.databarracks.com | 16www.databarracks.com | 16
RECOVERY
Time to recover:
6+ restores
Zero RPO
2 days 2 hours

www.databarracks.com | 17www.databarracks.com | 17
HOW TO
TEST?
Tutorial SAN Failure Cyber-Attack
http://www.databarracks.com/resources/tools/

www.databarracks.com | 18www.databarracks.com | 18
IF YOU REMEMBER NOTHING ELSE!
1. Have a specific incident response plan for
ransomware
2. Review backup schedules and retention policies
3.The only way to guarantee that you don’t lose your
data is with historic copies of your data in backup or DR

www.databarracks.com | 19
RESOURCES
• The Business Continuity Podcast
– http://www.thebcpcast.com/
• Tabletop testing simulator
https://tools.databarracks.com/dr-
tabletop-simulation/index.html
• History of ransomware
– https://heimdalsecurity.com/blog/what-is-
ransomware-protection/
• Ransomware definitions
– http://www.trendmicro.com/vinfo/us/security/defini
tion/ransomware
• SANS Institute, IncidentHandler's Handbook
– https://www.sans.org/reading-
room/whitepapers/incident/incident-handlers-
handbook-33901
• CryptoLocker DGA
– https://blog.fortinet.com/2014/01/16/a-closer-
look-at-cryptolocker-s-dga

www.databarracks.com | 20www.databarracks.com | 20
THE BCPCAST
http://www.thebcpcast.com/

Business continuity has a PR problem. From the outside, it seems boring, difficult, and not a priority. According to our 2017 Data Health Check, less than half of organisations with small IT teams (1-5) have a BC plan. The thing is, it’s never been easier. Continuity today is a mature area of study. There are established best practices and proven processes that do most of the heavy lifting for you.

The Databarracks Continuity Toolshed: Free tools for better recoveries

Databarracks

Over the past 3 years, we’ve been developing practical tools that take the heavy lifting out of in-depth continuity planning, making it faster and more approachable to newcomers. But there’s an important caveat. Shiny, interactive tools can trick you into feeling productive by outputting important-looking information. Without a plan, instructions, or good data, they’re not useful. That’s what The Recovery Toolshed: free tools for better recoveries is all about. Explaining how Databarracks range of free recovery tools combine to output meaningful metrics and useful information that can be practically applied to great continuity planning.

How would you recover? Lesson's from 2016's most interesting disasters

Databarracks

In 2016 we performed thousands of restores and recoveries for UK organisations. We’ve selected a few that stand out as excellent examples to review, and unpack, in order to break down how people reacted, and how the organisations involved recovered and survived. Join us in examining 6 real events that occurred to UK organisations last year, in order to become more resilient and better prepared for disruption.

How to invoke Disaster Recovery

Databarracks

How to know when combined backup and replication is for you

Databarracks

Why would anyone want to use two different products for backup and DR instead of one? You wouldn’t. If a single product reduces your IT complexity, you’re taking it, right? Vendors have always combined backup and replication, taking various approaches to deliver backup and DR in one product. This webinar shows you the pros and cons of each approach. And you’ll get recommendations to fit each use case.

How to write an IT DR plan

Databarracks

Yes, the recovery software is crucial, the failover environment must be stable and your connectivity must be reliable, but these are just components. Without a plan they’re useless. Having a well-designed and thoroughly tested plan in place will substantially increase your ability to withstand, and recover from, disruption. We'll share with you the methods, exercises, tools and expertise needed to create a plan that works when you need it most.

How to recover from ransomware

Databarracks

iland and Veeam recently conducted a data protection survey of IT organizations worldwide. In this webinar, we summarize and analyze the survey responses so you canunderstand today’s data protection landscape. Then, we cover best practices that can help ensure thatyour organization, and its data,are properly protected Watch the webinar on-demand: https://www.iland.com/wb-data-protection-report/

Varrow Madness 2014 DR Presentation

Andrew Miller

How to plan Disaster Recovery in a five simple steps

Pawel Maczka

Do not panic! You have a Disaster Recovery Plan, right❓ Whether you like it or not, your IT infrastructure is vulnerable. If you thought that making backups is enough to guarantee #businesscontinuity in the event of a disaster, you are wrong. ◾️ If something bad happens, how long will it take to recover my business data? ◾️ How will this affect my #business in the future? ◾️ How to resume operation after #disasterrecovery? ◾️ How much does it cost me to not have access to my critical data for some time? If you haven't asked yourself these questions, then you've probably never heard of a Disaster Recovery Plan. Better not to take this issue lightly, because it is assumed that 90% of companies without DRP will fail after a disaster. Moreover, nearly half of the small businesses that have implemented DR strategies, have never tested it.

How to Make an Effective Cloud Disaster Recovery Strategy.pdf

Sysvoot Antivirus

Problems are inevitable and a problem that hinders the operations of a company can be tagged as a Disaster. Technical glitches or security breaches can result in disasters and once it sets in, the organization can face huge issues. Now coming to disaster recovery. It can be defined as the process to evade or bounce back after a disaster. This helps them restore important documents. A cloud disaster recovery system aids the company to restore their files with the usage of cloud services.

How to setup disaster recovery

Databarracks

15 Minute Ransomware Survival Guide

Storage Switzerland

Ransomware is a new threat, and new threats require new strategies. Within the first 15 minutes this webinar will provide you key strategies for surviving a ransomware attack. During the event Storage Switzerland and Commvault cover the three P's of Ransomware survival: Prevention, Preparation and Practice. Join data protection experts with decades of experience protecting organization's digital assets.

Webinar: 2018 Disaster Recovery Checklist - 5 Key Areas to Improve

Storage Switzerland

Is your organization ready for any disaster 2018 may throw at it? Organizations not only face new threats they also encounter decreased tolerance for downtime from users. The good news is there are plenty of new solutions that claim to improve an organization’s ability to recover from a disaster. But which one makes the most sense for your organization? And what about your processes? Recovery technology needs to partner with solid DR processes in order for an organization to see its way through the challenges ahead.

Scenario based recovery metrics

Rod Davis

Continuity planners follow a methodology which elicits recovery requirements (RTO, RPO) from stakeholders and seeks to build capacity to meet those requirements. However, all disasters are not created equal and the reality is that most businesses, while able to meet those requirements for some scenarios, simply cannot meet them for more disruptive scenarios. Scenario-based Recovery Metrics give continuity planners a method to measure their ability to recover for a range of scenarios, from simpler to more complex. This facilitates measurement of deficits relative to the stakeholder's requirements for a range of scenarios. Furthermore, this method gives opportunity for continuity planners to dialogue with stakeholders and explain that 'we can meet your requirements for this set of simpler scenarios, however with our current recovery capacity we are unable to meet them for these more disruptive scenarios’. This dialogue 1.) Prevents unrealistic expectations and 2.) Lays the groundwork for making the case for budgets and projects for remediation of these deficits. These scenarios also provide a basis for the development of exercises to test recovery capability. Rod Davis, CRISC, CBCP

Haricharan Reddy(Netbackup)_resumeHaricharan Reddy

Disaster Recovery Planning

Keystone IT

2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation

Scott Sutherland

Business Continuity Planning with Bareos and rear (Loadays 2015)

Gratien D'haese

Bringing the Cloud Back to Earth

Sri Chalasani

webinar-level-up-your-cloud-security.pdf

banecomovil

World Wide Technology: Is backing up to the cloud right for you?

Angie Clark

Data protection and retention is critically important for commercial and public sector organizations alike. In fact, it is said that three things keep a CIO up at night: data failure, time to recovery and ensuring IT is able to meet recovery point objectives. Today, if you have a failure, the amount of time the business is without the data can determine if you need to start looking for a new job… This presentation will help the attendees: • Evaluate the business case for targeting your backups to the cloud • Identify candidate data sets for cloud backup and assess opportunities and readiness • Mitigate the challenges of backing up to the cloud • Build a roadmap to your cloud implementation WWT also provides some real-world experience via use cases and introduces several tools and methodologies used to evaluate, plan and execute your journey to cloud backup in this presentation. To find out more about WWT’s Data Protection team, log on to wwt.com.

November 2014 Webinar - Disaster Recovery Worthy of a Zombie Apocalypse

RapidScale

Disaster Recovery & Business Continuity Overview

Aventis Systems, Inc.

How to write a Business Continuity Plan

Databarracks

According to our 2023 Data Health Check, less than half of organisations have an up to date Business Continuity Plan. But creating a plan isn't hard, and we will show you the proven methods to deliver something practical and usable. Listen to the webinar and learn how to: - Identify your risks and create mitigation strategies - Create your Business Impact Analysis - Find the right people for an effective crisis team - Accurately identify the scope of continuity projects - Make testing and exercising more frequent, productive and frictionless

How to write an effective Cyber Incident Response Plan

Databarracks

Similar to How to recover from ransomware 2017

MGT3342BUS - Architecting Data Protection with Rubrik - VMworld 2017

Andrew Miller

WI_Symposium_Conference_2014Kevin McDaniel

Backups and Disaster Recovery for Nonprofits

Community IT Innovators

The Great Disconnect of Data Protection: Perception, Reality and Best Practices

iland Cloud

Varrow Madness 2014 DR Presentation

Andrew Miller

How to plan Disaster Recovery in a five simple steps

Pawel Maczka

How to Make an Effective Cloud Disaster Recovery Strategy.pdf

Sysvoot Antivirus

How to setup disaster recovery

Databarracks

15 Minute Ransomware Survival Guide

Storage Switzerland

Webinar: 2018 Disaster Recovery Checklist - 5 Key Areas to Improve

Storage Switzerland

Scenario based recovery metrics

Rod Davis

Haricharan Reddy(Netbackup)_resumeHaricharan Reddy

Disaster Recovery Planning

Keystone IT

2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation

Scott Sutherland

Business Continuity Planning with Bareos and rear (Loadays 2015)

Gratien D'haese

Bringing the Cloud Back to Earth

Sri Chalasani

webinar-level-up-your-cloud-security.pdf

banecomovil

World Wide Technology: Is backing up to the cloud right for you?

Angie Clark

November 2014 Webinar - Disaster Recovery Worthy of a Zombie Apocalypse

RapidScale

Disaster Recovery & Business Continuity Overview

Aventis Systems, Inc.

Similar to How to recover from ransomware 2017 (20)

MGT3342BUS - Architecting Data Protection with Rubrik - VMworld 2017

WI_Symposium_Conference_2014

Backups and Disaster Recovery for Nonprofits

The Great Disconnect of Data Protection: Perception, Reality and Best Practices

Varrow Madness 2014 DR Presentation

How to plan Disaster Recovery in a five simple steps

How to Make an Effective Cloud Disaster Recovery Strategy.pdf

How to setup disaster recovery

15 Minute Ransomware Survival Guide

Webinar: 2018 Disaster Recovery Checklist - 5 Key Areas to Improve

Scenario based recovery metrics

Haricharan Reddy(Netbackup)_resume

Disaster Recovery Planning

2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation

Business Continuity Planning with Bareos and rear (Loadays 2015)

Bringing the Cloud Back to Earth

webinar-level-up-your-cloud-security.pdf

World Wide Technology: Is backing up to the cloud right for you?

November 2014 Webinar - Disaster Recovery Worthy of a Zombie Apocalypse

Disaster Recovery & Business Continuity Overview

More from Databarracks

How to write a Business Continuity Plan

Databarracks

How to write an effective Cyber Incident Response Plan

Databarracks

Lessons from 100+ ransomware recoveries

Databarracks

How to write an IT Disaster Recovery Plan

Databarracks

The written plan is the most important part of any disaster recovery solution. Yes, the recovery software is crucial, the failover environment must be stable and your connectivity must be reliable, but these are just components. Without a plan they’re useless. Having a well-designed and thoroughly tested plan in place will substantially increase your ability to withstand, and recover from, disruption. We’re going to share with you the methods, exercises, tools and expertise needed to create a plan that works when you need it most. • Assessing your risks and creating a Business Impact Analysis • Setting realistic recovery objectives • Making incident response plans that work • How to communicate in a disaster

Cyber Incident Response Plan

Databarracks

Who's responsible for what in a crisis

Databarracks

How to communicate in a crisis

Databarracks

How to protect backups from ransomware

Databarracks

Requirements for cyber insurance

Databarracks

How to make your supply chain resilient

Databarracks

In Business Continuity, your most difficult challenge is making your supply chain resilient. A cyber attack on a supplier or a shortage of stock can immediately impact your operations but is much harder to resolve. We're sharing our Toolkit to let you measure, track and improve your supply chain resilience. Download the toolkit here: https://www.databarracks.com/resources/supplier-continuity-toolkit

How to recover from ransomware lessons from real recoveries

Databarracks

How to decommission a data centre

Databarracks

There are lots of reasons to decommission a data centre. Perhaps you’re closing down an office? Or saving money by outsourcing your Disaster Recovery? Maybe your hardware is reaching end-of-life and you’re moving to the cloud? But It’s not an easy project. It can take longer than expected, eating into cost-savings and brings an increased risk of service-interruption. Key takeaways: • A checklist for Discovery, Implementation and Disposal stages • How to create an accurate budget and timetable • Choosing between a phased or ‘big bang’ approach

Zerto in azure technical deep dive

Databarracks

How to write an effective Cyber Incident Response Plan

Databarracks

Introducing rubrik a new approach to data protection

Databarracks

DRaaS to Azure with Zerto

Databarracks

Microsoft Azure has become the default option for anyone migrating from on-site data centres to the cloud. It’s an obvious choice. Most IT departments are familiar and skilled with the Microsoft toolset, so for back-office systems it just makes sense. The question is, where to start? Setting up disaster recovery to Azure is a logical, low-risk first step. Profit from tricks on how to achieve a better TCO by using Azure for DRaaS: Replicating both VMware and Hyper-V environments Setting up the ZCA (Zerto Cloud Appliance) in Azure Connecting the ZVM (Zerto Virtual Manager) to your vCenter Using Blob storage for replica disks and journals Failing-over into Azure and failing-back

How to run a tabletop DR test

Databarracks

How to Develop and Deploy Web-Scale Applications on AWS

Databarracks

Johan Holder presents our checklist for deployment of web-scale applications on AWS. We cover the fundamentals you need to apply when moving applications from a legacy hosting provider or building new services from scratch. • How to architect your AWS environment to take advantage of specific services such as Elastic Load Balancing, CloudFront, Amazon SQS and S3. • How to build for scalability, resilience and security • How to manage your costs We also show you how to avoid the common mistakes we see organisations make when getting started with AWS.

Calculating the Cost of IT Downtime for Law Firms

Databarracks

Databarracks zerto - webinar - sept2015-slideshare

Databarracks

More from Databarracks (20)

How to write a Business Continuity Plan

How to write an effective Cyber Incident Response Plan

Lessons from 100+ ransomware recoveries

How to write an IT Disaster Recovery Plan

Cyber Incident Response Plan

Who's responsible for what in a crisis

How to communicate in a crisis

How to protect backups from ransomware

Requirements for cyber insurance

How to make your supply chain resilient

How to recover from ransomware lessons from real recoveries

How to decommission a data centre

Zerto in azure technical deep dive

How to write an effective Cyber Incident Response Plan

Introducing rubrik a new approach to data protection

DRaaS to Azure with Zerto

How to run a tabletop DR test

How to Develop and Deploy Web-Scale Applications on AWS

Calculating the Cost of IT Downtime for Law Firms

Databarracks zerto - webinar - sept2015-slideshare

Recently uploaded

FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf

FIDO Alliance

Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...

Jeffrey Haguewood

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the notifications, alerts, and approval requests using Slack for Bonterra Impact Management. The solutions covered in this webinar can also be deployed for Microsoft Teams. Interested in deploying notification automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

PCI PIN Basics Webinar from the Controlcase Team

ControlCase

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality

Inflectra

In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring. Learn about: • The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks. • Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective. • Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification. • Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process. Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.

GraphRAG is All You need? LLM & Knowledge Graph

Guy Korland

Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs. 1. Unifying Large Language Models and Knowledge Graphs: A Roadmap. https://arxiv.org/abs/2306.08302 2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs: https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/

AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...

Product School

UiPath Test Automation using UiPath Test Suite series, part 4

DianaGray10

Welcome to UiPath Test Automation using UiPath Test Suite series part 4. In this session, we will cover Test Manager overview along with SAP heatmap. The UiPath Test Manager overview with SAP heatmap webinar offers a concise yet comprehensive exploration of the role of a Test Manager within SAP environments, coupled with the utilization of heatmaps for effective testing strategies. Participants will gain insights into the responsibilities, challenges, and best practices associated with test management in SAP projects. Additionally, the webinar delves into the significance of heatmaps as a visual aid for identifying testing priorities, areas of risk, and resource allocation within SAP landscapes. Through this session, attendees can expect to enhance their understanding of test management principles while learning practical approaches to optimize testing processes in SAP environments using heatmap visualization techniques What will you get from this session? 1. Insights into SAP testing best practices 2. Heatmap utilization for testing 3. Optimization of testing processes 4. Demo Topics covered: Execution from the test manager Orchestrator execution result Defect reporting SAP heatmap example with demo Speaker: Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP

Neuro-symbolic is not enough, we need neuro-*semantic*

Frank van Harmelen

Neuro-symbolic (NeSy) AI is on the rise. However, simply machine learning on just any symbolic structure is not sufficient to really harvest the gains of NeSy. These will only be gained when the symbolic structures have an actual semantics. I give an operational definition of semantics as “predictable inference”. All of this illustrated with link prediction over knowledge graphs, but the argument is general.

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

DanBrown980551

Do you want to learn how to model and simulate an electrical network from scratch in under an hour? Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)! During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook. PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides: - A fully editable and extendable library for grid component modelling; - Visualization tools to display your network; - Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses; The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well. What you will learn during the webinar: - For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills; - For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.

Transcript: Selling digital books in 2024: Insights from industry leaders - T...

BookNet Canada

The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more. Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/ Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf

FIDO Alliance

Mission to Decommission: Importance of Decommissioning Products to Increase E...

Product School

Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...

Thierry Lestable

Securing your Kubernetes cluster_ a step-by-step guide to success !

KatiaHIMEUR1

Today, after several years of existence, an extremely active community and an ultra-dynamic ecosystem, Kubernetes has established itself as the de facto standard in container orchestration. Thanks to a wide range of managed services, it has never been so easy to set up a ready-to-use Kubernetes cluster. However, this ease of use means that the subject of security in Kubernetes is often left for later, or even neglected. This exposes companies to significant risks. In this talk, I'll show you step-by-step how to secure your Kubernetes cluster for greater peace of mind and reliability.

Connector Corner: Automate dynamic content and events by pushing a button

DianaGray10

Here is something new! In our next Connector Corner webinar, we will demonstrate how you can use a single workflow to: Create a campaign using Mailchimp with merge tags/fields Send an interactive Slack channel message (using buttons) Have the message received by managers and peers along with a test email for review But there’s more: In a second workflow supporting the same use case, you’ll see: Your campaign sent to target colleagues for approval If the “Approve” button is clicked, a Jira/Zendesk ticket is created for the marketing design team But—if the “Reject” button is pushed, colleagues will be alerted via Slack message Join us to learn more about this new, human-in-the-loop capability, brought to you by Integration Service connectors. And... Speakers: Akshay Agnihotri, Product Manager Charlie Greenberg, Host

FIDO Alliance Osaka Seminar: Overview.pdf

FIDO Alliance

FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf

FIDO Alliance

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

Prayukth K V

The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development. The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers: State of global ICS asset and network exposure Sectoral targets and attacks as well as the cost of ransom Global APT activity, AI usage, actor and tactic profiles, and implications Rise in volumes of AI-powered cyberattacks Major cyber events in 2024 Malware and malicious payload trends Cyberattack types and targets Vulnerability exploit attempts on CVEs Attacks on counties – USA Expansion of bot farms – how, where, and why In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East Why are attacks on smart factories rising? Cyber risk predictions Axis of attacks – Europe Systemic attacks in the Middle East Download the full report from here: https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/

Bits & Pixels using AI for Good.........

Alison B. Lowndes

To Graph or Not to Graph Knowledge Graph Architectures and LLMs

Paul Groth

Recently uploaded (20)

FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf

Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...

PCI PIN Basics Webinar from the Controlcase Team

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality

GraphRAG is All You need? LLM & Knowledge Graph

AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...

UiPath Test Automation using UiPath Test Suite series, part 4

Neuro-symbolic is not enough, we need neuro-*semantic*

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

Transcript: Selling digital books in 2024: Insights from industry leaders - T...

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf

Mission to Decommission: Importance of Decommissioning Products to Increase E...

Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...

Securing your Kubernetes cluster_ a step-by-step guide to success !

Connector Corner: Automate dynamic content and events by pushing a button

FIDO Alliance Osaka Seminar: Overview.pdf

FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

Bits & Pixels using AI for Good.........

To Graph or Not to Graph Knowledge Graph Architectures and LLMs

How to recover from ransomware 2017

1. How to recover from ransomware 2017

2. www.databarracks.com | 2www.databarracks.com | 2 INTRO & AGENDA Duration: 30 mins (including Q&A) Type questions on the right Q • What it is and how it works – How ransomware works and why it is breaching organisational defences. • Prevention & mitigation – Methods – The Incident and crisis management & escalation process • Recovery – A step-by-step guide to recovery *Slides will be made available and sent out following this session

3. www.databarracks.com | 3www.databarracks.com | 3 WHAT IS RANSOMWARE AND HOW DOES IT WORK?

4. www.databarracks.com | 4www.databarracks.com | 4 KEY FACTS • The encryption is to all intents unbreakable so backup data copies are the only guarantee to limit data loss • There is a deadline for payment – which forces action –recovery or payment

5. www.databarracks.com | 5www.databarracks.com | 5 WANNACRY • How it spreads – Installed by a worm – Uses Eternalblueexploit for Server Message Block (SMB) • US$300 ransom in bitcoins • Ransom doubled after 3 days • Files deleted after 7 days What’s different?What’s the same?

6. www.databarracks.com | 6www.databarracks.com | 6 HOW MANY DATABARRACKS CUSTOMERS WERE AFFECTED? 1

7. www.databarracks.com | 7 WHO IS BEING TARGETED AND WHY IS IT SO SUCCESSFUL? Why? Who?

8. www.databarracks.com | 8www.databarracks.com | 8 HOW DOES RANSOMWARE WORK - BACKGROUND

9. www.databarracks.com | 9www.databarracks.com | 9 HOW DOES RANSOMWARE WORK - BACKGROUND Installation Contact with command and control Search Encryption Ransom

10. www.databarracks.com | 10www.databarracks.com | 10 INCIDENT RESPONSE AND CRISIS MANAGEMENT ESCALATION Preparation Identification Containment Eradication Recovery Lessons learned Creatinga written policy and defining severity Identifyingwhether somethingis, or is notan incident The steps to limit the spread of ransomware Restorationof clean data from before the incident Bringingthe recoveredsystems back online How do we improve?

11. www.databarracks.com | 11www.databarracks.com | 11 HOW TO RECOVER vs Backup Disaster recovery

12. www.databarracks.com | 12www.databarracks.com | 12 HOW TO RECOVER • Increase the frequency of backups • Review (and extend) retention policies • Optimise connection speed between target and recovery environment (general) • Improvespeed of finding most recent clean backup Improving the Recovery Point Objective Improving the Recovery Time Objective

13. www.databarracks.com | 13www.databarracks.com | 13 RECOVERY Time to recover: 1 restore 24 hour RPO 3 days

14. www.databarracks.com | 14www.databarracks.com | 14 RECOVERY Time to recover: 1-2 restores 12 hour RPO 2.5 days

15. www.databarracks.com | 15www.databarracks.com | 15 RECOVERY Time to recover: 4-6 restores 4 hour RPO 2 days 4 hours

16. www.databarracks.com | 16www.databarracks.com | 16 RECOVERY Time to recover: 6+ restores Zero RPO 2 days 2 hours

17. www.databarracks.com | 17www.databarracks.com | 17 HOW TO TEST? Tutorial SAN Failure Cyber-Attack http://www.databarracks.com/resources/tools/

18. www.databarracks.com | 18www.databarracks.com | 18 IF YOU REMEMBER NOTHING ELSE! 1. Have a specific incident response plan for ransomware 2. Review backup schedules and retention policies 3.The only way to guarantee that you don’t lose your data is with historic copies of your data in backup or DR

19. www.databarracks.com | 19 RESOURCES • The Business Continuity Podcast – http://www.thebcpcast.com/ • Tabletop testing simulator https://tools.databarracks.com/dr- tabletop-simulation/index.html • History of ransomware – https://heimdalsecurity.com/blog/what-is- ransomware-protection/ • Ransomware definitions – http://www.trendmicro.com/vinfo/us/security/defini tion/ransomware • SANS Institute, IncidentHandler's Handbook – https://www.sans.org/reading- room/whitepapers/incident/incident-handlers- handbook-33901 • CryptoLocker DGA – https://blog.fortinet.com/2014/01/16/a-closer- look-at-cryptolocker-s-dga

20. www.databarracks.com | 20www.databarracks.com | 20 THE BCPCAST http://www.thebcpcast.com/

21. QUESTIONS?

How to recover from ransomware 2017

Recommended

Recommended

More Related Content

Similar to How to recover from ransomware 2017

Similar to How to recover from ransomware 2017 (20)

More from Databarracks

More from Databarracks (20)

Recently uploaded

Recently uploaded (20)

How to recover from ransomware 2017