Cyber-Security- WannaCry, Petya/NoPetya, Myths, Rescue Plan and Guide – teknospire
09
Aug

Cyber-Security- WannaCry, Petya/NoPetya, Myths, Rescue Plan and Guide

, , , , , , , , , , , , ,
0
Security

May 2017 would be remembered as one of the horrifying months for many firms and individuals who were under threat of WannaCry, followed by Petya. During this period, Google trends showed them as most searched keywords, few firms ran a scan to make sure things are in place, and many individuals were scared to perform any financial transactions. Now as August approached people have forgotten the “threat” and working to build something new and innovative. Is this the way we perceive security?
Original Image – Huffpost

  • Myths of Security

Many firms and individuals have not yet recognized what it means to be secured, here are some of the common myths prevailing in institutions and individuals.

  • Firewall protects me from all harm and danger

    • While firewall could help in creating a barrier for unrestricted access to a private network, it is not enough for you to protect from cyber threats like malware, data breach, ransomware or viruses.

    • I do not need complicated and expensive solution for my simple business/personal machine

      • While you build/buy a home for yourself, don’t you look for the security measures even if that means cutting on luxuries? Similarly for any business [big/small] or personal laptop protecting against the threat is crucial as once your data is lost or you lose your brand, it would be hard to recover it.

      • I do not have anything critical that would attract attackers

        • As per IBM report, 62% of cyber-attacks are aimed at small and medium sized enterprises, as they are easy targets.

        • After the attack, I would be able to restrict the damage done

          • You could cross the bridge when you come to it, but as per Trustwave Report, 81% of reported intrusions are highlighted by external sources like fraud monitoring or news rather than internal security processes.

          • I have a strong password

            • While inputting the password, the analytics besides it shows “very strong, ” and you are delighted as powerful password protects your system. Be it iris scanner, biometrics or keyboard driven password all are susceptible to be hacked and cracked.

            • Security will have lowest ROI

              • Do you mix investment and insurance? Similarly assigning ROI to security aspect itself is not a right notion. Since Security features itself to protect you and assuring you an ROI. Both in terms of tangible and non-tangible aspects to business.

              • Fact Sheet of Two Ransomware attacks

              WannaCry
              Petya/NoPetya
              When May 12, 2017 June 27, 2017
              Duration 4 days Several days
              How many computers affected 300,000 computers in over 150 countries 2,000 machines in around 65 countries
              Major Countries Impacted Russia, China, US, UK Ukraine, Europe, US, Australia
              Total Ransom Paid 327 payments worth $130,634.7 4.03929745 BTC / 11,121 USD
              Losses estimated $4 billion NA
              Unrepairable Loss Emotional and Brand Reputation Data Loss
              How It Happened A hacking group called the Shadow Brokers took advantage of an NSA spy tool to exploit a vulnerability in Microsoft PCs. Microsoft had created a free patch a month earlier, but many organizations did not implement the fix. As a result, hospitals, banks, schools, and businesses were forced to their knees. The UK’s National Health Service was particularly hard hit, as patients and ambulances were turned away and hospitals operated on an emergency-only basis The attack started in Ukraine, shutting down the Ukrainian government, bank, postal service, transportation services and power companies. Petya shared many similarities with WannaCry, such as its spread through Microsoft Windows and demand for a $300 Bitcoin ransom. Unlike WannaCry, however, Petya exploited multiple vulnerabilities as opposed to one, had no “kill switch,” and gave victims no recourse to their data — since the contact email for doing so was shut down Major corporations such as WPP, Maersk, Russian oil giant Rosneft, and public and private institutions in Ukraine have been hit

              Sources – Cloudendure , Franciskim , ZDnet and CNBC

              • Protection Plan for Enterprises, Small Businesses, and Consumers against Ransomware

              Less than half of global SMBs think they’re at risk of suffering a ransomware attack this year, despite more than 60% having already been affected, according to new research from Webroot . Just two-fifths (42%) claimed ransomware was a significant external security threat this year, despite major global attacks such as WannaCry and ‘Petya.’ Higher up on the list were DDoS (43%), phishing (47%), mobile attacks (48%) and “new forms of malware infections” (56%). So what could be done to protect your business or personal machine from these threats?

              Type of Business Email and web protection Server Protection End point Protection Network Protection
              Enterprises

              Small Businesses

              Consumer

              Source – TrendLabs

              • Quick Guide to Cyber Security

              As pointed earlier ransomware is not the only security threat that businesses need to gear up for, there are phishing, malware or DDoS so what could be done to prevent against any such attacks. Follow our quick guide –

              • Continuous Monitoring

                • Continuous monitoring of logs and network is essential to detect unusual patterns or unauthorized access to the system. One could use cyber security analytics that could help you in breaking down the barriers.

                • Get Educated

                  • Establish Security process within an organization. Dos and Donts, security training, etc. to all your employees so that they know what as an organization is being done to fight cyber threats. USB’s or other media storage devices being used in several computers often carry viruses with them. Hence it would be beneficial first to get it checked or could be made inaccessible.