Ransomware in 2022
New Jersey Tech Leader Exclusive Insights

Ransomware in 2022
New Jersey Tech Leader Exclusive Insights

Written by Joe Cannata

Posted on December 20, 2021

If you had a chance to sit down with a seasoned cybersecurity professional, what questions would you ask them as you prepare your organization for the next year? The Techsperts team offers an exclusive feed on how to fight ransomware in 2022.

Ransomware attacks have sadly become commonplace. Huge enterprise businesses, gas pipelines, universities, and even cities have been crippled by ransomware and forced to pay huge ransoms. What can an individual or a business do to prevent and repel a ransomware attack?

The cybersecurity space has become so important to modern business organizations. With threats always looming around every corner, leaders and security professionals at all levels must start to question their current strategies and develop new ways of dealing with the ever-evolving threats. Here is what I believe will be a game changer for any organization.

Email Security

The number of data breaches from email sources is mind-boggling. However, many organizations wait until it’s too late before they start setting up email security practices. Attackers already know that more users are now aware of basics like verifying addresses, making them go for more sophisticated phishing techniques.

The modern organization requires a mix of different strategies to secure their corporate emails from malware and fishing, and I’ll explain how some of the work:

• One of the big ones is using antivirus to scan email attachments for malware. Avoid opening unsolicited attachments before verifying the source and scanning them for viruses.
• Organizations should establish strong password practices, making it hard for hackers to access personal email accounts. Longer passphrases are easy to remember and much harder to crack, and they fit within the criteria for strong passwords.
• Invest in good filtering programs to filter all inbound and outbound emails, perform URL filtering. Depending on your content filter ratings, the software will scan message content and mark it for deletion, quarantine, or rejection.
• Email encryption is one of the best ways to protect your communications from being intercepted over the internet. It is one area that we can’t ignore going by recent developments in data privacy regulation.

Zero Trust Policies

Zero trust policies essentially tell the system that it doesn’t have to learn who you are until you have identified yourself. Every action must be validated, whether you’re simply trying to access the system or you’re making a change. Before the move to zero trust, the unspoken rule within organizations was that everything happening within their networks could be trusted.

But when attacks become more sophisticated, hackers could launch viruses from within, and CISO’s needed to review how everything connected to their systems, both internally and externally. The first step in implementing a zero-trust system will be identifying the network’s most critical systems and devices. We also need to identify our users and prioritize controlling access to the more sensitive assets.

Trusting way too much on this day will be self-sabotage, and every security professional should ensure that they address every user, application, and infrastructure with a zero-trust approach.

Next-Gen Antivirus

The next generation of antivirus programs employ machine learning technologies to identify and remove threats. We are dealing with more sophisticated malware as hackers strive to be one step ahead of the cybersecurity profession. Regular antivirus programs have been unable to stop many of the attacks we’ve experienced in recent years.

The trend is unlikely to change, and if it does, we expect to see more malware bypassing normal antivirus. IT security’s challenge in this environment will be to wage battle with similarly sophisticated software, and that’s where next-gen malware comes in.

Loading antivirus software and letting it deal with the problems is no longer a strategy and the conventional software products are not suited to the new environment.

Next-gen antivirus takes on some IT admin roles by employing artificial intelligence to monitor user behaviors and scan endpoints for suspicious patterns. It’s always improving itself by learning its environment and rewriting rules to provide solutions to the changing security threats.

Dark Web Monitoring

The anonymity provided by the dark web affords criminals the luxury to sell or leak compromised user passwords and credit card information. Previously, no cybersecurity professional wanted to go down this alley, fearing exposing their networks to malicious attacks.

Poring through the hidden network unravels a great deal of information that would help in securing our data.

For example, a business can learn if they’ve been breached by following conversations on some dark web forums.  It helps you learn the source of the attacks and some tools used. If you’re lucky, you might thwart an impending attack just by knowing what methods are going to be used.

Much of the data sold in the dark is usually gotten from phishing scams, social engineering, and malware attacks. Most hackers usually go big by attacking thousands of user accounts and selling them in bulk. The sophistication that phishing and social engineering have taken these days raises the need to educate our users consistently.

User Training

End-user training is one of the simplest ways to reduce cybersecurity risks. It removes you from dealing with low-level threats to focus your energies on more sophisticated attacks. With modern systems providing endless touchpoints between internal and external users, it became necessary to cascade cybersecurity training from IT security to the first-line worker.

Effective security awareness programs should use multiple strategies to reach the audience. Rather than spend long hours of training in conference rooms, sometimes it’s easy to choose short, pop-up messages on the computer. The main goal is to ensure that you’re relevant, memorable, and interactive, because what’s the point of training if you can’t get any feedback?

You could use cybersecurity events to enforce some lessons learned. We have seen more organizations implementing cybersecurity week and holding daily security trivia, and winners are awarded.

Understanding human behavioral patterns will do a great deal of justice in ensuring that you’re using the right training programs. Besides, most system vulnerabilities stem from erratic human behavior.

Ransomware Protection In New Jersey By Techsperts

Cyberattacks are usually random, but we need focused strategies to keep them under control. When used effectively, the five tips will mark the difference between successful and struggling organizations going into 2022 and beyond. For more IT resources, contact us today.

Special thanks to my colleague Aaron Kane with CTI Technology in Chicago for his help with this research.