How to Recover from a Ransomware Disaster

© Copyright 2017 – Spanning Cloud Apps1
SPANNINGSPANNINGSPANNINGSPANNING
How to Recover from a
Ransomware Disaster
Mat Hamlin | VP of Products
Brian Rutledge | Principal Security Engineer

SPANNINGSPANNING2 © Copyright 2017 – Spanning Cloud Apps
Cybersecurity Ventures
predicts that Ransomware
damage costs will exceed $5
billion in 2017, up more than
15X from 2015.
Costs include:
• Damage or loss of data
• Downtime
• Lost productivity
• Forensic investigation
• Restoration and deletion of
hostage data and systems
• Reputational harm
• Employee training
$5B(Yes, that’s billion)

SPANNINGSPANNING
Agenda
• The Anatomy of a Ransomware Attack (101)
• Ransomware: Past, Present and Future
• How to prepare for an attack
• Why recovery has become the #1 recommendation
• How Spanning can help

SPANNINGSPANNING
01 02 03
• Exploit a software
vulnerability
• Trick someone into
executing malicious code
• Compromise a password
and act as a legitimate
user
• Search for critical files
locally, on the network,
and in the cloud
• Contact command and
control service
• Utilize access to spread to
others
• Encrypt files or lock
access to system
• Hold data ransom,
demanding payment via
Cryptocurrency
• Unlock upon payment
(maybe)
Encrypt &
ransom
Land & expandFind a way in
Anatomy of a Ransomware Attack (101)

SPANNINGSPANNING

SPANNINGSPANNING
CryptoWall
Entry Point:
Java vulnerability exploit
delivered via malicious ads on
domains like Disney &
Facebook
from Windows
Impact:
- Scans for and encrypts
files
- Includes network shares
- Looks for cloud drives

SPANNINGSPANNING
Patcher
Entry Point:
BitTorrent download
masquerading as Adobe
Premiere CC or Office 2016
updates
… to Mac
Impact:
- Copies and encrypts files
- Removes original files (rm)
- Wipes free space (diskutil)

SPANNINGSPANNING
DoubleLocker
Entry Point:
Identifies and infects insecure
websites, tricks users into
installing by masquerading as
an Adobe Flash Update
installer
…to Android
Impact:
- Encrypts files
- Sets itself as the default
app
- Changes the lock PIN

SPANNINGSPANNING
iCloud Hack
Entry Point:
Compromised iCloud
accounts were used to Lock
Apple devices and demand a
ransom or threaten a full
remote wipe.
…to iOS
(sort of)
Impact:
- Locks access to device
- Potential deletion of all
data

SPANNINGSPANNING
What would be needed?
Entry Point to Execute:
- Scripting or APIs
- Requires only a click to
grant
- Propagate through sharing
…to Cloud?
Impact:
- Gains full access to data
- Gain full access to email
- Potential data leakage or
destruction

SPANNINGSPANNING
How to Prepare for an Attack
Safeguard Your Business
with Modern Technology
Today’s software applications
and computing devices
leverage built-in security, such
as encryption and access
controls, to better protect
business data.
Develop a Response
and Recovery Plan
Pretend you’ve been attacked.
Leverage cybersecurity
insurance to help respond,
cover first and third-party
damages, and lost income.
Recover with proven backup
and recovery solutions and
procedures.
Build a Culture of
Security
Establish and educate your
employees on basic security
practices, policies and rules of
behavior for how to handle and
protect customer information
and other vital data.

SPANNINGSPANNING
Top Challenges After an Attack
• Required response is not well understood
• Incomplete or inadequate response plan
• Lack of funding to properly execute response and recovery
• Steps to complete recovery are unclear
• Inability to properly recover lost or damaged data
• Organization cannot meet defined recovery time objective (RTO)
• Lack of communications plan, both internally and externally

SPANNINGSPANNING
Detect
Anomalies and
Events
Detection
Process
Continuous
Monitoring
Respond
Response
Planning
Communication
Analysis
Mitigation
Improvements
Recover
Recovery
Planning
Improvements
Communication
Protect
Policies
Processes
Data Security
Access Control
Protective
Technology
Awareness and
Training
Identify
Business
Environment
Risk
Governance
Asset
Management
Risk
Assessment
Risk
Management
NIST CYBERSECURITY FRAMEWORK
Make
cybersecurity a
priority
Figure out
where you are
Identify your
critical assets
Assess your risk
of attack and
risk of recovery
Train your
people
Apply patches
Get protection
software
Set password
polices and
access controls
Reduce shadow
IT
Define what
you’re looking
for
Get a solution
that is scanning
and monitoring
activity
Establish a
reporting
process for your
people
Get
Cybersecurity
insurance
Tell your people
Determine what
you are required
to do in each of
the legal
jurisdictions you
operate
Fall forward
Get a Backup
and recovery
solution
Pretend you’ve
been attacked
and perform a
restore
Identify gaps in
restoration
correctness and
performance

SPANNINGSPANNING
Why backup is the #1 recommendation
• Most Ransomware is not preventable
• New strains are identified every month
• People will always make mistakes
• There’s no guarantee your files will be returned
• If you do pay, you’ll get attacked again
• Compliance controls require rapid recovery
• Knowing you can recover puts you in control

SPANNINGSPANNING

SPANNINGSPANNING
Enterprise class security
SOC 2 type II certified, HIPAA, end-to-end encryption
Cloud-to-cloud service
Installs in minutes, with no hardware or installed software
Simple, per-user subscription
Aligns with SaaS vendors, delivering predictable costs
Unlimited storage and retention
Removes the hassle and costs of managing storage
SPANNING BACKUP
for Office 365
SPANNING BACKUP
for Salesforce
SPANNING BACKUP
for G Suite

SPANNINGSPANNING
Enterprise-grade protection for
SharePoint, Mail, OneDrive for Business
and Calendars
PROTECT RECOVER COMPLY
Protect your critical
business data with
automated and on-
demand backups
Recover data
quickly and easily
with self-service
restore from any
point-in-time backup
for Office 365
Comply with
regulatory and
legal controls for
data protection and
business continuity
SPANNING BACKUP
for Office 365

SPANNINGSPANNING
True, point-in-time restore
Critical for recovery from ransomware
Accurate, granular search & restore
Find and restore what you need quickly and accurately
Cross-user restore
Streamlines data transfer during user off-boarding*
Rapid Recovery
*Does not apply to SharePoint restore functionality

SPANNINGSPANNING
Secure authorization
No credentials stored; revoke API access anytime
Complete activity log
Detailed visibility to all administrator and user actions
Enterprise grade security
SOC 2 Type II certified with 256-bit encryption for all data
Enterprise Trust

SPANNINGSPANNING
Restore data from any device
Built for desktop, tablet and mobile; the way users work
End user & admin restore
capabilities
Reduces admin support needs, speeds time to restore
Intuitive design
Designed for the end user - no training required
Easy for Everyone

SPANNINGSPANNING
Prepare for data loss
not covered by your
SaaS provider. We
provide unlimited
storage.
Empower end users and
admins to quickly restore
any or all data from
previous point-in-time.
Unlimited recovery at your
fingertips.
Comply with your defined
business continuity and
data management controls.
Close the protection
gap
Reduce the cost of
recovery
Meet compliance
obligations

SPANNINGSPANNING
Learn More
spanning.com/resources
@spanningbackup
SpanningCloudApps
Start a 14-day
FREE TRIAL

How to Recover from a Ransomware Disaster

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to How to Recover from a Ransomware Disaster

Similar to How to Recover from a Ransomware Disaster (20)

More from Spanning Cloud Apps

More from Spanning Cloud Apps (10)

Recently uploaded

Recently uploaded (20)

How to Recover from a Ransomware Disaster