The City of Johannesburg suffered another ransomware attack, having been targeted in July as well.  Both incidences occurred around the 25^th of the month when most South Africans receive their salaries and do payments, highlighting the fact that ransomware attackers will exploit flaws in IT infrastructure at critical times to gain optimum leverage.

According to Zamani Ngidi, Client Manager: Cyber Solutions at Aon South Africa, the importance of addressing an incident correctly at the point of its occurrence, is crucial.  “Taking a proactive approach that is aimed at remediating the elements that lead to a cyber event in order to prevent it from occurring again is at the heart of the matter.  Time is absolutely of the essence,” he adds.

The risk that cybercrime poses is here, and it is very real. “A lack of reporting on the matter is leaving many in the dark as to the resultant costs that a business could suffer as a result of a cyber breach, not only from an incident response perspective but also the subsequent business costs associated with a breach of this nature that can include aspects such as business interruption through to reputational damage,” explains Zamani.

“The city of Johannesburg is not the only entity suffering from cyber breaches, it is simply the only one in the paper this morning.  Many companies simply do not have the luxury of a big balance sheet to absorb the risk,” says Zamani.  “It necessitates a major shift in business thinking to view cyber risk as both a strategic and critical risk that holds a very real threat to business and its operations.  Proactive steps need to be put in place in order to prevent a business from becoming a statistic as far as possible in addition to having a solid incident response plan in place in a worst-case scenario,” he adds.

The nature of cyber attacks

Attackers are utilising forms of benign malware—such as software designed to cause distributed denial-of-service (DDoS) attacks or launching display ads on thousands of systems— to unleash huge outbreaks of ransomware. Botnet operators will grant ransomware attackers access to botnet nodes in exchange for payments, allowing them to significantly expand the scope of a ransomware attack. 

“While attackers will continue to launch scatter-gun-style attacks to disrupt as many systems as possible, we are also seeing increasing instances of attackers targeting specific companies and demanding ransomware payments proportional to the value of the encrypted assets. This can be quite significant in an event where cyber criminals manage to get their hands on sensitive and distinguishable client information, of which there has been ample, high-profile examples in South Africa,” says Zamani. 

To achieve stronger returns in these targeted attacks, criminals will hit environments where access to data and systems is mission critical, such as hospitals, transportation companies and manufacturing companies. We also expect to see an increase in the use of ransomware to infect IoT devices, which come with a diminished set of security features by default to facilitate out-of-the-box functionality, and users tend to maintain these original settings once the devices start functioning. Aon has already seen the Mirai botnet that harnessed IoT devices to launch DDoS attacks and anticipate ransomware to infect smart thermostats and other smart devices.

In addition, cryptocurrencies will continue to support the flourishing ransomware industry overall, despite law enforcement becoming more advanced in their ability to trace attacks, for example, through bitcoin wallets.

Addressing the issue

According to Zamani, companies will have to go beyond the vital step of creating backups, to protect themselves. “Companies will need to utilise systems that can create snapshots in time or maintain multiple versions of files created over the course of the day, to enable restoration to a specific point in time prior to the backup with minimal loss of productivity. Security professionals will need to routinely test if their backups allow them to restore the data and files in a specific timeframe to ascertain the downtime the company can withstand if a ransomware attack is realised.” 

“We will also see more companies recognising the need to implement the Principle of Least Privilege—limiting file access rights for users to the bare minimum permissions they need to perform their work to reduce the number of files that could be encrypted in the event of a ransomware attack. Advanced companies will grant employees only the access needed for the business activities of a specific function, rather than providing automatic access to everything,” he adds. 

With perpetrators carrying out wide-scale, profitable, and disruptive attacks in recent years, the number of attackers, the volume of ransomware families, and the number of infections increased dramatically. The trend is continuing, with attackers launching large-scale attacks, but also evolving their tactics to implement targeted attacks with demands for greater payments proportional to the value of the assets. This activity will be supported by the continued rise of cryptocurrencies.

The following questions from Aon will give an indication on how risk ready your organisation is to face a ransomware attack:

• When was the last time you reviewed your company’s patch management program? Your disaster recovery and business continuity plans?
• Can you identify where all of your mission critical data resides and whether regular backups are being made?
• Does your cyber insurance policy provide adequate coverage? Have you taken the necessary steps to ensure you will be eligible to make a claim if your company is impacted?
• Have you communicated with employees about the latest phishing and social engineering techniques?
• Do you have an incident response plan in place and has it recently been tested so everyone knows what to do in the event of an attack?
• Are all necessary technical and procedural controls in place and operating properly?
• Has your security posture recently been assessed and tested and have you acted on the results?

“Whether you are a big or small operator, your company’s ability to protect against and recover from ransomware attacks rely on implementing proactive technical measures and business continuity plans.  That is why you need a qualified risk advisor by your side who is able to take your business through a comprehensive cyber risk assessment in order to mitigate the risk of unwarranted access to your most crucial data,” concludes Zamani.