Why Banking on Backups to Fight Ransomware is not Enough Anymore
martyb writes:
Why you can't bank on [just] backups to fight ransomware anymore:
[...] [The] belief that no personally identifying information was breached in [a] ransomware attack is common among victims of ransomware-and that's partially because ransomware operators had previously avoided claiming they had access to victims' data in order to maintain the "trust" required to extract a payment. Cyber insurance has made paying out an attractive option in cases where there's no need for an organization to reveal a breach, so the economics had favored ransomware attackers who provided good "customer service" and gave (usually believable) assurances that no data had been taken off the victims' networks.
Unfortunately, that sort of model is being blown up by the Maze and Sodinokibi (REvil) ransomware rings, which have adopted a model of using stolen data as leverage to ensure customers will make a payment. Even in cases where a victim can relatively quickly recover from a ransomware attack, they still will face demands for payment in order to avoid the publication or sale of information stolen by the attackers before the ransomware was triggered.
Maze and REvil are targeted ransomware attacks that break from the established norm of ransomware attacks in other ways. Telling users not to click on email attachments and to recognize phishing sites isn't stopping these attackers from getting in. Both have relied on exploits of known weaknesses in Internet-facing infrastructure of their victims-be it an Oracle WebLogic vulnerability, a long-ago patched weakness in Pulse Secure VPN servers, or hacks of managed service providers' systems.
Being able to quickly get back up and running after a breach is a very good thing. It is also not enough. Preventing attackers from exfiltrating confidential information is likely more difficult and potentially more costly. Especially since Europe enacted GDPR (General Data Protection Regulation) and some other jurisdictions in the US have enacted laws requiring prompt disclosure and notification after a breach.
Read more of this story at SoylentNews.