During our summer break, Los Angeles Valley College in Valley Glen became the latest institution to pay ransom in bitcoins (US$28,000) to extortionists after malware encrypted hundreds of thousands of files held on its servers. In addition to losing data access, important services went down, including the College’s network, email and phone system.

The FBI estimates that victims worldwide paid $1 billion in ransom during 2016, and that the figure could double for this year

In the U.K., nearly two-thirds of universities have had their computer systems held up for ransom by hackers, according to a 2016 report, with some hit by multiple attacks.

Canada has also reported a rise in attacks on universities over the past year.

Tips for preventing ransomware attacks?

• Education: employee awareness training should be in place to ensure the threat of ransomware is properly understood and steps individual users can take to reduce the risk of compromise from user interaction with both malicious emails and websites.

• Ensure you have a clearly documented and agreed upon incident response plan detailing the steps the organisation will take in response to a ransomware compromise. A backup copy of this plan should be stored offline.

• Understand the value of your organisations information to others. Apply the appropriate level of controls such as encryption and two-factor authentication to ensure your most valuable information is protected.

• Back-up. Ensure you have a recovery system in place so a ransomware infection can’t destroy your information. In additional to creating a local copy of your data, we also recommend creating an off-network copy of your all sensitive information.

• Restore of backed up data should be tested regularly to ensure they are reliable and effective.

• Keep all the software on your computer up to date. When your operating system (OS) or applications release a new version, install it. Enable the feature to automatically apply updates if available.

• Trust no one. Any account can be compromised and malicious links can be sent from the accounts of friends on social media, or colleagues.

• Never open attachments in emails from someone you don’t know. Cybercriminals often distribute fake email messages that look very much like email notifications from an online store, your work, a financial institution, the police, tax office, Australia Post, luring recipients into clicking on a malicious link and releasing the malware into their system.

• Implement application whitelisting or, at least, software restriction policies to hinder the ability of malware to execute successfully.

• Use network segmentation (via VLANs and ACLs) to assist with preventing the spread of a ransomware infection throughout your organisation’s IT infrastructure, isolating the infection to one network segment.

• Deploy and manage appropriately configured firewalls and network and host based prevention/detection systems to identify, prevent and issue alerts for outbound communication attempts to malicious IP addresses.

• Deploy and manage spam filtering tools to intercept ransomware variants that are spread via malicious email attachments.

• Use up to date endpoint-based solutions such as anti-virus (either a next-gen anti-virus product that has strong ransomware detection capabilities such as Cylance, CarbonBlack etc.) or a signature-based solution .

• Establishing and enforce removable media policies to reduce the risk of ransomware spreading via USB drives etc.

Additional Resources

Both OWASP and CERT Australia have put together useful guides on strategies for businesses to respond to ransomware attacks.

We would like to acknowledge Nick Ellsmore from Hivint for assisting with developing this advice.

By Louise Schuster, AARNet’s Director, Cyber Security