440890252-RANSOMWARE.cybersecurity-ppt.pptx

Ransomware PPT

1. RANSOMWARE Cyber security

2. Overview Below is what we will be going over in our presentation. Introduction of Ransomware. Background and history of Ransomware. Types of Ransomware attacks. What you can do to protect yourself from Ransomware. Backup and DR planning. Real world examples of Ransomware.

3. What is Ransomware? One of the most prominent and fast growing threats which: 1.Takes users files 2. Encrypts them 3. And creates a decryption key This makes the user’s files inaccessible until some sort of Ransom is paid. Two main types of Ransomware. 1. Encryptors- which incorporate encryption algorithm s to black system files and demand some sort of payment to be able to access the key to decrypt victims files. 2. Locker – completely locks users out of their devices by not allowing them to or locking them out of their operating system until the desired ransom is paid.

4. History of Ransomware It’s been said that Ransomware was introduced as an AIDS Trojan in 1989 when Harvard-educated biologist Joseph L. Popp sent 20,000 compromised diskettes named “AIDS Information – Introductory Diskettes” to attendees of the internal AIDS conference organized by the World Health Organization. The Trojan worked by encrypting the file names on the customers’ computer and hiding directories. The victims were asked to pay $189 to PC Cyborg Corp. at a mailbox in Panama. From 2006 and on, cybercriminals have become more active and started using asymmetric RSA encryption. They launched the Archives Trojan that encrypted the files of the My Documents directory. Victims were promised access to the 30-digit password only if they decided to purchase from an online pharmacy. After 2012, ransomware started spreading worldwide, infecting systems and transforming into more sophisticated forms to promote easier attack delivery as the years rolled by. In Q3, about 60,000 new ransomware was discovered, which doubled to over 200,000 in Q3 of 2012. The first version of  CryptoLocker   appeared in September 2013 and the first copycat software called Locker was introduced in December of that year. Ransomware has been creatively defined by the U.S. Department of Justice as  a new model of cybercrime with a potential to cause impacts on a global scale . Stats indicate that the use of ransomware is on a steady rise and according to Veeam, businesses had to pay $11.7 on average in 2017 due to ransomware attacks. Alarmingly, the annual ransomware-induced costs, including the ransom and the damages caused by ransomware attacks, are most likely to shoot beyond $11.5 billion by 2019

5. Birth and Evolution of Ransomware Early Years 1. Born in 1989 and given the name “AIDS” 2. Focused attacks primarily in the healthcare industry 3. Encrypted files on a system and demanded ransom to decrypt them Evolution and Adaptability 1. Utilization of more sophisticated algorithms such as RSA 2. Usage and ransom of cryptocurrencies like bitcoin to maintain anonymity. 3. Pre-built infrastructures and AES-256 encryption promote wide distribution.

6. Types of Ransomware Attacks Locker Ransomware Deny access to computing resources. Locks computer Displays official message Limits user’s capabilities Crypto Ransomware Find and encrypt valuable data stored on user’s computer Makes data useless Computer does not have limited access Attacker uses information to extort the user into giving them money

7. Jigsaw Ransomware Encrypts important information Starts deleting the files until ransom is paid 72 hour mark and the user loses all their information KeRanger Ransomware Encrypt Mac users backup files Not able to recover anything Ransom of about $400 WannaCry Encrypts user’s data Ransom of about $300 using Bitcoins Increases ransom or delete the user’s files stored in the computer

8. How Ransomware works Ransomware is a prominent and fast growing threat which takes user files, encrypts them and creates decryption key making the user’s files inaccessible until some sort of ransom is paid Ransomware attacks work in that malware sent from the hacker can be spread through malicious email attachments, infected external storage devices and websites that are compromised

9. Anatomy of ransomware attack A ransomware attack is a multi-step process. If the proper defenses are in place at the various steps of the attack, the impact can be greatly reduced. Delivery and exploit:  Ransomware is delivered through a certain mechanism (e.g.: phishing) and finds a vulnerability or a victim to attack Install and disarm:  Ransomware installs itself and lower the security poster of the victim machine Occupy and encrypt:  Establish communication with the command and control server and encrypt data files and mapped drivers Demand ransom:  Users attempt to access files and are alerted that the data has been encrypted Decrypt:  Decryption keys will only be provided on payment of a ransom

10. Secure and Protect On the computer Do not store important data Backup important files After usage, disconnect from the cloud In the Browser Remove plugins from your browser Adjust browser’s security settings Use an ad blocker Security Tools Have a real time scanner Have your firewall on Use internet security suite’s

11. Online Do not open spam emails Never download attachments from spam email Only open emails from known recipients Infected? Disconnect your computer Contact and IT professional Report the crime If absolutely necessary, pay the ransom

12. Why backup testing & Having a DR plan Many organizations recognize the need for a disaster recovery plan; however the majority don’t have one in place. Those that have a DR plan often don’t test it. 80% of U.S. companies lack a DR plan 50% of small and midsized businesses (SMBs) worldwide have no DR plan 72% of SMBs worldwide that have a DR plan have never tested it 25% of reported DR tests fail So why aren’t DR plans being tested, or being tested more often? 40% of SMBs fear that DR testing will impact their business operations and their customers 27% of SMBs fear disruption to their sales and revenue 48% of SMBs claim that they lack the resources to test their DR plans on a regular basis

13. Building a disaster recovery plan Disaster recovery planning  is the plan put in place to recover from a disaster or interruption of key services. The business continuity plan includes: Creating of business continuity and disaster recovery policy Business impact analysis Classification of operations and criticality analysis Development of a  business continuity  plan and  disaster recover  procedures Training and awareness, Testing Ongoing Monitoring

14. Know your environment and SLA’S Recovery point objectives How much lost data can you afford? Data size/change rate (i.e. what is feasible?) Recovery time objectives How long can you afford to be down? SLA’s Determine Which Cloud Provider Depending on the recovery time, 4 different ways to choose: 3 RD Party Cloud, Replication, DRaaS or Manufacturers Cloud

15. Real world examples of Ransomware