Schließen
Schließen
Ihr Netzwerk von morgen
Ihr Netzwerk von morgen
Planen Sie Ihren Weg zu einem schnelleren, sichereren und widerstandsfähigeren Netzwerk, das auf die von Ihnen unterstützten Anwendungen und Benutzer zugeschnitten ist.
          Erleben Sie Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            Ein führendes Unternehmen im Bereich SSE. Jetzt ein führender Anbieter von SASE.
            Ein führendes Unternehmen im Bereich SSE. Jetzt ein führender Anbieter von SASE.
            Netskope debütiert als Leader im Gartner ® Magic Quadrant ™ für Single-Vendor SASE
              Generative KI für Dummies sichern
              Generative KI für Dummies sichern
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                Moderne Data Loss Prevention (DLP) für Dummies
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Modernes SD-WAN für SASE Dummies-Buch
                  Modern SD-WAN for SASE Dummies
                  Hören Sie auf, mit Ihrer Netzwerkarchitektur Schritt zu halten
                    Verstehen, wo die Risiken liegen
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        Die 6 überzeugendsten Anwendungsfälle für den vollständigen Ersatz älterer VPNs
                        Die 6 überzeugendsten Anwendungsfälle für den vollständigen Ersatz älterer VPNs
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          Colgate-Palmolive schützt sein "geistiges Eigentum" mit intelligentem und anpassungsfähigem Datenschutz
                          Colgate-Palmolive schützt sein "geistiges Eigentum" mit intelligentem und anpassungsfähigem Datenschutz
                            Netskope GovCloud
                            Netskope erhält die FedRAMP High Authorization
                            Wählen Sie Netskope GovCloud, um die Transformation Ihrer Agentur zu beschleunigen.
                              Let's Do Great Things Together
                              Die partnerorientierte Markteinführungsstrategie von Netskope ermöglicht es unseren Partnern, ihr Wachstum und ihre Rentabilität zu maximieren und gleichzeitig die Unternehmenssicherheit an neue Anforderungen anzupassen.
                                Netskope solutions
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Technischer Support von Netskope
                                  Technischer Support von Netskope
                                  Überall auf der Welt sorgen unsere qualifizierten Support-Ingenieure mit verschiedensten Erfahrungen in den Bereichen Cloud-Sicherheit, Netzwerke, Virtualisierung, Content Delivery und Software-Entwicklung für zeitnahen und qualitativ hochwertigen technischen Support.
                                    Netskope-Video
                                    Netskope-Schulung
                                    Netskope-Schulungen helfen Ihnen, ein Experte für Cloud-Sicherheit zu werden. Wir sind hier, um Ihnen zu helfen, Ihre digitale Transformation abzusichern und das Beste aus Ihrer Cloud, dem Web und Ihren privaten Anwendungen zu machen.

                                      Using Visibility to Combat Against Ransomware

                                      Dec 30 2021

                                      In the first half of 2021, average ransomware demands surged by 518%, while payments climbed by 82%. There has been a growing number of attacks in healthcare, with 560 healthcare facilities hit by ransomware last year in the U.S. alone. 

                                      As new attacks generate headlines each week, we get real-world use cases for how ransomware proliferates in diverse ways, including social engineering attacks and exploitation of vulnerabilities. These incidents not only cost millions of dollars in recovery, but they also have led to delays in patient treatment and possibly even loss of life.

                                      In addition to working with Netskope’s healthcare customers, I also run our corporate security operations, so I’m obviously concerned about ransomware myself—what could happen, how it might be triggered, and its impact on the organization.

                                      With ransomware so rampant, organizations are starting to focus on what other layers can be put in place to combat the attacks. Most organizations start with basic email security, deploying a secure email gateway (SEG)—but that only gets you so far. There will always be a way for an attacker to push a link or a file that gets past these controls, so we must look at attack vectors holistically.

                                      Greater complexity increases the attack surface

                                      How we deal with ransomware today is evolving because our users are evolving. Our devices are BYOD and our data is no longer sitting in a physical server in an on-premise data center where we have physical access. For the most part, it’s now hosted somewhere else in the world on machines that are managed and maintained by another company.

                                      Oddly, a lot of teams let their guards down because of that. They assume if their public cloud gets encrypted, someone else will step in and everything will magically be okay. They tell themselves that the cloud provider can probably revert all the files back to a previous version and it won’t be a big deal. In some cases and with some providers that might be possible—but in some cases, it’s not.

                                      The risk factors with ransomware call for a proactive approach to both prevention and recovery, should the worst happen. It can really come down to one user making an errant click that subsequently shuts down the entire network.

                                      As an attacker, I just need one click to put an entire company at risk. When you look at 10% across a company of 1,500 people, that’s 150 clicks. People are going to make mistakes—even extremely smart, well-educated, and security-savvy people. So, if we’re never going to have environments that are protected 100% of the time, how are we going to deal with it when that errant click does happen?

                                      Setting aside the issue of whether you should ever pay a ransom, there are really two things to consider when it comes to preparing for a ransomware attack:

                                      • If your data gets encrypted (or is otherwise lost or offline due to catastrophe), you need to be able to restore your systems as quickly as possible
                                      • Even after your operations are back online, there’s still the worry that an attacker may have also exfiltrated sensitive or private data.

                                      The evolution to cloud-based recovery systems

                                      The recovery process is often the last thing anyone thinks about. Disaster recovery and business continuity (DRBC) is probably the toughest piece to solve and, often, the most ignored. But if your organization is in healthcare or part of critical infrastructure like utilities, there can be life-and-death consequences to service interruptions. Ensuring business continuity might mean the ability to keep working to save lives, which means that immediate time-to-recovery is going to be very important.

                                      In the past, we used to have to go and pull tapes from an archive at some off-site place to restore systems—and that could take days. A few years ago, many businesses had backup systems inside a hosted data center, allowing them to restore from another server by replicating data across the pipe. That was a lot quicker than tape backups, but it still had limitations. Today, cloud-hosted solutions make things much easier because they take snapshots in time of your data. For this reason, cloud storage makes DRBC much faster than legacy solutions that are still stuck in a physical-servers-and-appliances frame of mind.

                                      To stay ahead of ransomware, businesses need to step up their game and move to a next generation cloud-based DRBC strategy. One of the main reasons why many organizations have not taken this critical step is that they’re worried about the security of those cloud environments.

                                      A recent Cloud Security Alliance (CSA) study showed that security remains a major concern when it comes to cloud adoption for 58% of respondents. But that fear is creating a different risk when it comes to fast, seamless recovery and continuity of operations from a debilitating outage—whether it’s caused by ransomware, a natural disaster, or any other reason.

                                      And the fact is, compared to many of the old secondary storage approaches, the cloud can offer better visibility and control of your data than servers in a physical data center. Your time-to-recovery can be much quicker, and your uptime can be much better.

                                      Ensuring data visibility

                                      Within healthcare it’s not necessarily just about getting access to your data back, but what else happened during that encryption process. Did the attackers damage the data? Was the privacy of your patients also breached in the process of this attack? A US government cybersecurity alert not long ago warned specifically about spiking ransomware activity targeting the healthcare and public health sector—specifically calling out threats that carry out both disruption of services and data theft.

                                      The second part of ransomware preparedness is about establishing comprehensive visibility of your data. Data classification makes this possible. You want to be able to inventory all your data—tagging it according to type, sensitivity, and location. Visibility helps us put policies in place to ensure sensitive information never leaves the organization, and it also helps block files that violate policy (such as cloud-stored ransomware) from coming in based on their classification. It simultaneously helps us keep the good stuff in and the bad stuff out.

                                      With ransomware, you never know if a link or file somehow made it past security controls by clever means to trick someone into innocently opening it. The perfect example is somebody applying for a job. A “job applicant” might send a Dropbox, Google Drive, or OneDrive link to their resume or work sample portfolio in response to an HR posting—but what’s waiting there is ransomware, launched into your organization from the cloud platform. The attack vector has evolved from the file having to physically enter your network to having delivery access from the edge.

                                      When I think about ransomware, I start by thinking about how my users interact with external or even other internal users. Work communications have transcended email and evolved toward dedicated team collaboration tools—sometimes employees even use them just to chat and catch up socially. As a result, we’re now increasingly seeing these tools used as an attack vector.

                                      If an attacker feels like an organization has great email security and all of their users are well-trained to avoid email-based phishing attacks, then what about a link to a Google Drive or Dropbox folder where the payload is located and it doesn’t necessarily have to come through an email? Instead, it can come through Slack or WebEx Teams. The attacker just has to be able to elicit a single click on a link to launch their malware and start the encryption process. Having transparent visibility and policy-based controls in place can help prevent that from happening.

                                      SASE and beyond – Zero trust

                                      With a secure access service edge architecture (SASE) architecture and data loss prevention (DLP) capabilities, I can protect our users inside of what I know—OneDrive or Google Drive, or our corporate Slack channel. The problem is, I don’t know what I don’t know.

                                      Greater mobility, BYOD policies, SaaS applications, and the spike in remote workers have made things even more complicated, especially over the last 18 months. So, I also need visibility and policy-based controls to keep malicious files from being downloaded onto any device that is authorized to have our data.

                                      This is also where zero trust becomes part of the story – or as I like to think of it, continuous adaptive trust. We need to expand full security visibility beyond just data to also have a comprehensive view of users, devices, and applications. This gives us a greater capacity for enforcing granular, role-based controls and reducing the opportunities for threats (including ransomware) to penetrate the network in the first place. The more we know about our expanded network environments, the better we can protect our users, devices, applications, and data from disruption.

                                      This article was originally published by HelpNet Security

                                      author image
                                      Damian Chung
                                      Damian Chung is a cybersecurity leader with over ten years of security experience in healthcare. Damian is responsible for corporate security tools and processes.
                                      Damian Chung is a cybersecurity leader with over ten years of security experience in healthcare. Damian is responsible for corporate security tools and processes.

                                      Bleiben Sie informiert!

                                      Abonnieren Sie den Netskope-Blog