O Futuro de Zero Trust e de SASE Começa Hoje! Inscreva-se já

fechar
fechar
A plataforma do futuro é a Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) e Private Access for ZTNA integrados nativamente em uma única solução para ajudar todas as empresas em sua jornada para o Secure Access Service Arquitetura de borda (SASE).

Vá para a plataforma
Vídeo da Netskope
Next Gen SASE Branch é híbrida — conectada, segura e automatizada

Netskope Next Gen SASE Branch converge o Context-Aware SASE Fabric, Zero-Trust Hybrid Security e SkopeAI-Powered Cloud Orchestrator em uma oferta de nuvem unificada, inaugurando uma experiência de filial totalmente modernizada para empresas sem fronteiras.

Saiba mais sobre Next Gen SASE Branch
Pessoas no escritório de espaço aberto
Desenvolvendo uma Arquitetura SASE para Leigos

Obtenha sua cópia gratuita do único guia de planejamento SASE que você realmente precisará.

Baixe o eBook
Adote uma arquitetura Secure Access Service Edge (SASE)

O Netskope NewEdge é a maior nuvem privada de segurança de alto desempenho do mundo e oferece aos clientes cobertura de serviço, desempenho e resiliência inigualáveis.

Conheça a NewEdge
NewEdge
Sua Rede do Amanhã

Planeje seu caminho rumo a uma rede mais rápida, segura e resiliente projetada para os aplicativos e usuários aos quais você oferece suporte.

Receba o whitepaper
Sua Rede do Amanhã
Netskope Cloud Exchange

O Cloud Exchange (CE) da Netskope oferece aos clientes ferramentas de integração poderosas para tirar proveito dos investimentos em estratégias de segurança.

Saiba mais sobre o Cloud Exchange
Vídeo da Netskope
Mude para serviços de segurança na nuvem líderes de mercado com latência mínima e alta confiabilidade.

Conheça a NewEdge
Lighted highway through mountainside switchbacks
Permita com segurança o uso de aplicativos generativos de IA com controle de acesso a aplicativos, treinamento de usuários em tempo real e a melhor proteção de dados da categoria.

Saiba como protegemos o uso de IA generativa
Ative com segurança o ChatGPT e a IA generativa
Soluções de zero trust para a implementação de SSE e SASE

Conheça o Zero Trust
Boat driving through open sea
Netskope obtém alta autorização do FedRAMP

Escolha o Netskope GovCloud para acelerar a transformação de sua agência.

Saiba mais sobre o Netskope GovCloud
Netskope GovCloud
  • Recursos chevron

    Saiba mais sobre como a Netskope pode ajudá-lo a proteger sua jornada para a nuvem.

  • Blog chevron

    Saiba como a Netskope viabiliza a segurança e a transformação de redes através do security service edge (SSE).

  • Eventos e workshops chevron

    Esteja atualizado sobre as últimas tendências de segurança e conecte-se com seus pares.

  • Security Defined chevron

    Tudo o que você precisa saber em nossa enciclopédia de segurança cibernética.

Podcast Security Visionaries

Cookies, não biscoitos
A apresentadora Emily Wearmouthas se reúne com os especialistas David Fairman e Zohar Hod para discutir o passado, o presente e o futuro dos cookies da Internet.

Reproduzir o podcast
Podcast: Biscoitos, Não Biscoitos
Últimos blogs

Como a Netskope pode habilitar a jornada Zero Trust e SASE por meio dos recursos de borda de serviço de segurança (SSE).

Leia o Blog
Sunrise and cloudy sky
SASE Week 2023: Sua jornada SASE começa agora!

Replay das sessões da quarta SASE Week anual.

Explorar sessões
SASE Week 2023
O que é o Security Service Edge?

Explore o lado de segurança de SASE, o futuro da rede e proteção na nuvem.

Saiba mais sobre o Security Service Edge
Four-way roundabout
  • Nossos clientes chevron

    Netskope atende a mais de 2.000 clientes em todo o mundo, incluindo mais de 25 dos 100 da Fortune.

  • Customer Solutions chevron

    Estamos aqui junto com você a cada passo da sua trajetória, assegurando seu sucesso com a Netskope.

  • Netskope Community chevron

    Aprenda com outros profissionais de rede, dados e segurança.

  • Treinamento e certificação chevron

    Os treinamentos da Netskope vão ajudar você a ser um especialista em segurança na nuvem.

Ajudamos nossos clientes a estarem prontos para tudo

Ver nossos clientes
Woman smiling with glasses looking out window
A talentosa e experiente equipe de Serviços Profissionais da Netskope fornece uma abordagem prescritiva para sua implementação bem sucedida.

Conheça os Serviços Profissionais
Netskope Professional Services
A Comunidade Netskope pode ajudar você e sua equipe a obter mais valor de produtos e práticas.

Acesse a Comunidade Netskope
A Comunidade Netskope
Proteja sua jornada de transformação digital e aproveite ao máximo seus aplicativos de nuvem, web e privados com o treinamento da Netskope.

Saiba mais sobre Treinamentos e Certificações
Group of young professionals working
  • Empresa chevron

    Ajudamos você a antecipar os desafios da nuvem, dos dados e da segurança da rede.

  • Por que Netskope chevron

    A transformação da nuvem e o trabalho em qualquer lugar mudaram a forma como a segurança precisa funcionar.

  • Liderança chevron

    Nossa equipe de liderança está fortemente comprometida em fazer tudo o que for preciso para tornar nossos clientes bem-sucedidos.

  • Parceiros chevron

    Fazemos parceria com líderes de segurança para ajudá-lo a proteger sua jornada para a nuvem.

Apoiando a sustentabilidade por meio da segurança de dados

A Netskope tem o orgulho de participar da Visão 2045: uma iniciativa destinada a aumentar a conscientização sobre o papel da indústria privada na sustentabilidade.

Saiba mais
Apoiando a sustentabilidade por meio da segurança de dados
O mais alto nível de Execução. A Visão mais avançada.

A Netskope foi reconhecida como Líder no Magic Quadrant™ do Gartner® de 2023 para SSE.

Obtenha o Relatório
A Netskope foi reconhecida como Líder no Magic Quadrant™ do Gartner® de 2023 para SSE.
Pensadores, construtores, sonhadores, inovadores. Juntos, fornecemos soluções de segurança na nuvem de última geração para ajudar nossos clientes a proteger seus dados e seu pessoal.

Conheça nossa equipe
Group of hikers scaling a snowy mountain
A estratégia de comercialização da Netskope, focada em Parcerias, permite que nossos Parceiros maximizem seu crescimento e lucratividade enquanto transformam a segurança corporativa.

Saiba mais sobre os parceiros da Netskope
Group of diverse young professionals smiling

Using Visibility to Combat Against Ransomware

Dec 30 2021

In the first half of 2021, average ransomware demands surged by 518%, while payments climbed by 82%. There has been a growing number of attacks in healthcare, with 560 healthcare facilities hit by ransomware last year in the U.S. alone. 

As new attacks generate headlines each week, we get real-world use cases for how ransomware proliferates in diverse ways, including social engineering attacks and exploitation of vulnerabilities. These incidents not only cost millions of dollars in recovery, but they also have led to delays in patient treatment and possibly even loss of life.

In addition to working with Netskope’s healthcare customers, I also run our corporate security operations, so I’m obviously concerned about ransomware myself—what could happen, how it might be triggered, and its impact on the organization.

With ransomware so rampant, organizations are starting to focus on what other layers can be put in place to combat the attacks. Most organizations start with basic email security, deploying a secure email gateway (SEG)—but that only gets you so far. There will always be a way for an attacker to push a link or a file that gets past these controls, so we must look at attack vectors holistically.

Greater complexity increases the attack surface

How we deal with ransomware today is evolving because our users are evolving. Our devices are BYOD and our data is no longer sitting in a physical server in an on-premise data center where we have physical access. For the most part, it’s now hosted somewhere else in the world on machines that are managed and maintained by another company.

Oddly, a lot of teams let their guards down because of that. They assume if their public cloud gets encrypted, someone else will step in and everything will magically be okay. They tell themselves that the cloud provider can probably revert all the files back to a previous version and it won’t be a big deal. In some cases and with some providers that might be possible—but in some cases, it’s not.

The risk factors with ransomware call for a proactive approach to both prevention and recovery, should the worst happen. It can really come down to one user making an errant click that subsequently shuts down the entire network.

As an attacker, I just need one click to put an entire company at risk. When you look at 10% across a company of 1,500 people, that’s 150 clicks. People are going to make mistakes—even extremely smart, well-educated, and security-savvy people. So, if we’re never going to have environments that are protected 100% of the time, how are we going to deal with it when that errant click does happen?

Setting aside the issue of whether you should ever pay a ransom, there are really two things to consider when it comes to preparing for a ransomware attack:

  • If your data gets encrypted (or is otherwise lost or offline due to catastrophe), you need to be able to restore your systems as quickly as possible
  • Even after your operations are back online, there’s still the worry that an attacker may have also exfiltrated sensitive or private data.

The evolution to cloud-based recovery systems

The recovery process is often the last thing anyone thinks about. Disaster recovery and business continuity (DRBC) is probably the toughest piece to solve and, often, the most ignored. But if your organization is in healthcare or part of critical infrastructure like utilities, there can be life-and-death consequences to service interruptions. Ensuring business continuity might mean the ability to keep working to save lives, which means that immediate time-to-recovery is going to be very important.

In the past, we used to have to go and pull tapes from an archive at some off-site place to restore systems—and that could take days. A few years ago, many businesses had backup systems inside a hosted data center, allowing them to restore from another server by replicating data across the pipe. That was a lot quicker than tape backups, but it still had limitations. Today, cloud-hosted solutions make things much easier because they take snapshots in time of your data. For this reason, cloud storage makes DRBC much faster than legacy solutions that are still stuck in a physical-servers-and-appliances frame of mind.

To stay ahead of ransomware, businesses need to step up their game and move to a next generation cloud-based DRBC strategy. One of the main reasons why many organizations have not taken this critical step is that they’re worried about the security of those cloud environments.

A recent Cloud Security Alliance (CSA) study showed that security remains a major concern when it comes to cloud adoption for 58% of respondents. But that fear is creating a different risk when it comes to fast, seamless recovery and continuity of operations from a debilitating outage—whether it’s caused by ransomware, a natural disaster, or any other reason.

And the fact is, compared to many of the old secondary storage approaches, the cloud can offer better visibility and control of your data than servers in a physical data center. Your time-to-recovery can be much quicker, and your uptime can be much better.

Ensuring data visibility

Within healthcare it’s not necessarily just about getting access to your data back, but what else happened during that encryption process. Did the attackers damage the data? Was the privacy of your patients also breached in the process of this attack? A US government cybersecurity alert not long ago warned specifically about spiking ransomware activity targeting the healthcare and public health sector—specifically calling out threats that carry out both disruption of services and data theft.

The second part of ransomware preparedness is about establishing comprehensive visibility of your data. Data classification makes this possible. You want to be able to inventory all your data—tagging it according to type, sensitivity, and location. Visibility helps us put policies in place to ensure sensitive information never leaves the organization, and it also helps block files that violate policy (such as cloud-stored ransomware) from coming in based on their classification. It simultaneously helps us keep the good stuff in and the bad stuff out.

With ransomware, you never know if a link or file somehow made it past security controls by clever means to trick someone into innocently opening it. The perfect example is somebody applying for a job. A “job applicant” might send a Dropbox, Google Drive, or OneDrive link to their resume or work sample portfolio in response to an HR posting—but what’s waiting there is ransomware, launched into your organization from the cloud platform. The attack vector has evolved from the file having to physically enter your network to having delivery access from the edge.

When I think about ransomware, I start by thinking about how my users interact with external or even other internal users. Work communications have transcended email and evolved toward dedicated team collaboration tools—sometimes employees even use them just to chat and catch up socially. As a result, we’re now increasingly seeing these tools used as an attack vector.

If an attacker feels like an organization has great email security and all of their users are well-trained to avoid email-based phishing attacks, then what about a link to a Google Drive or Dropbox folder where the payload is located and it doesn’t necessarily have to come through an email? Instead, it can come through Slack or WebEx Teams. The attacker just has to be able to elicit a single click on a link to launch their malware and start the encryption process. Having transparent visibility and policy-based controls in place can help prevent that from happening.

SASE and beyond – Zero trust

With a secure access service edge architecture (SASE) architecture and data loss prevention (DLP) capabilities, I can protect our users inside of what I know—OneDrive or Google Drive, or our corporate Slack channel. The problem is, I don’t know what I don’t know.

Greater mobility, BYOD policies, SaaS applications, and the spike in remote workers have made things even more complicated, especially over the last 18 months. So, I also need visibility and policy-based controls to keep malicious files from being downloaded onto any device that is authorized to have our data.

This is also where zero trust becomes part of the story – or as I like to think of it, continuous adaptive trust. We need to expand full security visibility beyond just data to also have a comprehensive view of users, devices, and applications. This gives us a greater capacity for enforcing granular, role-based controls and reducing the opportunities for threats (including ransomware) to penetrate the network in the first place. The more we know about our expanded network environments, the better we can protect our users, devices, applications, and data from disruption.

This article was originally published by HelpNet Security

author image
Damian Chung
Damian Chung is a cybersecurity leader with over ten years of security experience focused in healthcare. As the Business Information Security Officer at Netskope, Damian is responsible for overseeing corporate security tools and processes and acts as the subject matter expert in the healthcare vertical. He also serves as an adjunct professor for the cybersecurity program at the University of Advancing Technologies in Tempe, AZ.

Stay informed!

Subscribe for the latest from the Netskope Blog