Ransomware A case study of the impact, recovery and remediation events

Size: px

Start display at page:

Download "Ransomware A case study of the impact, recovery and remediation events"

Christal Warner
5 years ago
Views:

com Peter Thermos President & CTO Tel: (732) 688-0413 peter.thermos@palindrometech.

1 Ransomware A case study of the impact, recovery and remediation events Palindrome Technologies 100 Village Court Suite 102 Hazlet, NJ Peter Thermos President & CTO Tel: (732) peter.thermos@palindrometech.com Christopher Reid SIEM Administrator chris.reid@palindrometech.com Palindrome Technologies all rights reserved 2016 PG: 1

2 What is the IT Team s estimated cost of a breach or ransomware attack? Have they computed this? Lisa Jackson asked a great question at the June GPA meeting What can she ask her IT department as part of Cyber Security Readiness? How does the IT Team feel about their vulnerability management program? Has the IT Team had a 3 rd party vulnerability assessment / penetration testing? If so, how often do they rotate vendors? Has the IT Team budgeted for cyber security in the coming year? Has the IT Team educated their staff on Cyber Security Awareness? Does the IT Team maintain a written Information Security Policy? Who reviews it? Palindrome Technologies all rights reserved 2016 PG: 2

3 Lisa Jackson asked a great question at the June GPA meeting What can she ask her IT department as part of Cyber Security Readiness? What is the IT Team s Incident Response capabilities in the event of a Cyber Attack? How are Cyber Insurance requirements validated? Does a 3 rd party verify the declarations? Is the Information Technology Team ready to Learn Security Forward Palindrome Technologies all rights reserved 2016 PG: 3

NJ Statistics on Cyber Security Cybersecurity is hardly the

2015, Study on NJ Municipalities and Cybersecurity 565 Local

Party IT Audit 76% 9 local governments have data breach

30 local governments commissioned third-party audit and/or

5 NJ Statistics on Cyber Security Cybersecurity is hardly the only area that governments need to consider as they try to cut down on technological risk Ref: M. Pheiffer, Rutgers University Nov. 2015, Study on NJ Municipalities and Cybersecurity 565 Local Governments 3rd Party IT Audit 24% 174 Evaluated No 3 rd Party IT Audit 76% 9 local governments have data breach policy Only 56 have performed any sort of strategic planning 30 local governments commissioned third-party audit and/or intrusion testing Its 10pm, do you know where your data breach policy is? Palindrome Technologies all rights reserved 2016 PG: 5

6 Events The steps to contain and recover from attack and also institute a vulnerability and threat management program. Detection Analysis and containment Recovery Remediation a) Event detected by Municipality IT b) Impacted critical servers and workstations a) Palindrome engaged b) Performed server and network traffic forensics c) Determined that a user s workstation was infected d) Attack vector: Phishing e) Workstation Antivirus not updated a) IT team recovered affected files from backups b) Enhanced firewall filters c) Performed Vulnerability Assessment & penetration testing d) Developed a Remediation Plan a) Addressed vulnerabilities identified from penetration testing (patches, host/wifi configuration, network controls) b) Deployment of SIEM Network/Host monitoring Vulnerability Management c) Awareness Training Palindrome Technologies all rights reserved 2016 PG: 6

Attack User receives promotional email Email contains a link to a file containing

ransomware silently propagates to local drive and network shares! URL Downloads a.

!! Within 1 hour of attack the infection propagated on domain servers and started

7 Attack User receives promotional contains a link to a file containing the ransomware Once the user downloads and opens the file they get infected The ransomware silently propagates to local drive and network shares! URL Downloads a.zip file that contains malware!!! Within 1 hour of attack the infection propagated on domain servers and started encrypting files Tuesday 9:00AM - Users can t access files on critical servers Palindrome Technologies all rights reserved 2016 PG: 7

8 spear-phishing Attack Overview The attacker may: Address the recipient by name Use lingo/jargon of the organization Reference actual procedures or instructions that the user is familiar The appears to be genuine. Sometime these s have legitimate operational and exercise nicknames, terms, and key words in the subject and body of the message. Palindrome Technologies all rights reserved 2016 PG: 8

Employee Training Phish-Me-Not Palindrome s Phish-Me-Not service

to avoid Phishing Attacks and Social Engineering Attacks including

Phishing attacks are the most prevalent method of distributing

!! Phishing Attack The Happy Organization Computer User FREE

12 Employee Training Phish-Me-Not Palindrome s Phish-Me-Not service trains your most vulnerable asset the Municipal Computer User how to avoid Phishing Attacks and Social Engineering Attacks including Vishing, tailgating, media drop, combination attacks. Phishing attacks are the most prevalent method of distributing Encryption malware. Mr. Evil Hacker says Pay me in Bitcoins!!! Phishing Attack The Happy Organization Computer User FREE Phish-Me-Not Demonstration available. Palindrome Technologies all rights reserved 2016 PG: 12

Analysis, containment, recovery Host Forensics Recovery Analyze active memory, processes, OS logs, filesystem and network shares to determine behavioral patterns of ransomware (Cryptowall).

13 Analysis, containment, recovery Host Forensics Recovery Analyze active memory, processes, OS logs, filesystem and network shares to determine behavioral patterns of ransomware (Cryptowall). Network Forensics Network traffic captures & firewall logs were reviewed in order to extract traffic patterns that may help narrow the initial activity of the malware. Containment Plan Stringent User permissions Firewall filters to prevent inbound/outbound propagation, Update antivirus/malware signatures Examine and validate if most recent backup reference is infected Restore data from backup prior to infection Prepare remediation strategy Hosted awareness training Palindrome Technologies all rights reserved 2016 PG: 13

14 Data Breach Impact Notification and Response Costs Emergency Response and Remediation Public loss of PII State and Federal requirements Vendor notification Lost Employee Productivity Diverted employee attention from work Attack may disable communications Employees unable to communicate with customers / residents Breach Costs Permanent Loss Data pay Ransom? Credibility of Organization Legal Protection Lawsuits Cyber Insurance Do you have the right coverage??? Was Due Diligence Completed? Palindrome Technologies all rights reserved 2016 PG: 14

Threat Remediation Perform Vulnerability Assessment &

Program Categorize/Prioritize Vulnerabilities and develop

Management) Remediate Vulnerabilities Security is a

15 Threat Remediation Perform Vulnerability Assessment & Penetration Testing Establish Continuous Monitoring Program Categorize/Prioritize Vulnerabilities and develop remediation plan Deploy SIEM (Vulnerability and Threat Management) Remediate Vulnerabilities Security is a process not a product! Palindrome Technologies all rights reserved 2016 PG: 15

Managing Cyber Threats Managed Services Security Information and Event Management - SIEM Log analysis Linked to the intrusion detection and incident response plan Alerting - Configure and receive

17 Managing Cyber Threats Managed Services Security Information and Event Management - SIEM Log analysis Linked to the intrusion detection and incident response plan Alerting - Configure and receive automatic alerts based on customized event thresholds. Event Correlation - Multiple forms of event correlation are available for all events including statistical anomalies, associating IDS event with vulnerabilities, and alerting on 'first time seen' events. Log Normalization - Normalize, correlate, and analyze user and network activity from log data generated by any device or application across the enterprise in a central portal. User Monitoring - Monitor user activity. Associate events such as a NetFlow, IDS detection, firewall log activity, file access, system error, or login failure with specific users for easy reporting and insider threat detection. Malware Detection - monitors all processes running on Windows machines for malware processes, and can alert the security team if malware is discovered. Palindrome Technologies all rights reserved 2016 PG: 17

SIEM Correlation Directives Snort: *ET TROJAN CryptoLocker EXE

About Palindrome Professional Services Information Security and Assurance Vulnerability Assessments Penetration Testing Risk and Threat Analysis Security Policy Architecture Review Forensics Incident

20 About Palindrome Professional Services Information Security and Assurance Vulnerability Assessments Penetration Testing Risk and Threat Analysis Security Policy Architecture Review Forensics Incident Response Governance Compliance Disaster Recovery Planning Managed Services SIEM Alerting Event Correlation Log Normalization User Monitoring Malware Detection Mobile Security Solutions Recap Mobile Security Vulnerability and Threat Management Palindrome Technologies all rights reserved 2016 PG: 20

21 Q & A Peter Thermos, MSc President & CTO Chris Reid SIEM/MSS Cell: +1(732) Peter.thermos@palindrometech.com 100 Village Court Hazlet, NJ USA Village Court Hazlet, NJ USA Cell: +(732 ) Chris.reid@palindrometech.com Assurance, Trust, Confidence Palindrome Technologies all rights reserved 2016 PG: 21

Ransomware A case study of the impact, recovery and remediation events

Ransomware A case study of the impact, recovery and remediation events Peter Thermos President & CTO Tel: (732) 688-0413 peter.thermos@palindrometech.com Palindrome Technologies 100 Village Court Suite