Here’s how you can secure yourself from personal ransomware attacks

Now your office, organisation, institution is already doing what it needs to in order to keep themselves safe from one of the biggest ransomware Cyber Attacks and an attack of this mammoth size should act as a reminder for personal users like you and I to prepare for personal ransomware attacks.

Just so that you know, the new ransomware, named as “WannaCry”, is a malware that encrypts contents on infected Windows systems and demands payment in bitcoins for amount ranging from $300 to $600 to release your data. It has already spread across over 100 countries affecting Hospitals in England, Interior Ministry in Russia, Germany train station, Fedex USA and Academic Institutes in China. And India is one of the key targets. Anand Ramamoorthy, Managing Director, India & SAARC, McAfee says, “The WannaCry attacks is perhaps one of the largest and most widespread ransomware attack in recent history, with India being a prime target. The most affected were those, who were running old and unpatched software, which threatens more than just data of the consumers. Hackers could even use the promise of a WannaCrypt fix as bait for further infections, hence users have to be extremely skeptical.

Since this ransomware only attacks Windows System, first and foremost in order to prevent infection you need to apply patches to Windows systems as mentioned in Microsoft Security Bulletin MS17-010.

So once you have done that here are the three key rules to keeping safe online

1. Back up your files

Always make sure your files are backed up. That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore the data from the backup.

2. Update your devices

There are a few lessons to take away from WannaCry, but making sure your operating system is up-to-date needs to be near the top of the list. The reason is simple: nearly every software update contains security improvements that help secure your computer and removes the means for ransomware variants to infect a device.

3. Faith in Cloud

Using cloud storage with anti-virus scanning abilities to share files will help users to mitigate any possible threats.”

And apart from these three key rules that will keep you safe from a cyber attack here’s a detailed list of best practices from CERT-In (National Nodal Agency for responding to computer security incidents) to prevent Ransomeware attacks.

• Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
• Establish a Sender Policy Framework (SPF),Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
• Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization's website directly through browser
• Restrict execution of powershell /WSCRIPT in enterprise environment Ensure installation and use of the latest version (currently v5.0) of PowerShell, with enhanced logging enabled. script block logging, and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis.
• Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA%, %PROGRAMDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations. Enforce application whitelisting on all endpoint workstations.
• Deploy web and email filters on the network. Configure these devices to scan for known bad domains, sources, and addresses; block these before receiving and downloading messages. Scan all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution.
• Disable macros in Microsoft Office products. Some Office products allow for the disabling of macros that originate from outside of an organization and can provide a hybrid approach when the organization depends on the legitimate use of macros. For Windows, specific settings can block macros originating from the Internet from running.
• Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares.
• Maintain updated Antivirus software on all systems
• Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
• Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
• Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements, (backdoors /malicious scripts.)
• Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.
• Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
• Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
• Disable remote Desktop Connections, employ least-privileged accounts.
• Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems, Check regularly for the integrity of the information stored in the databases.
• Restrict users' abilities (permissions) to install and run unwanted software applications.
• Enable personal firewalls on workstations.
• Implement strict External Device (USB drive) usage policy.
• Employ data-at-rest and data-in-transit encryption.
• Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empaneled auditors. Repeat audits at regular intervals.
• Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies