We use cookies to give you the best experience on our website. You can choose which cookies you want to allow below. You can find more details in our privacy policy.
Purpose | So that the user's cookie preferences can be taken into account, these are stored in the cookies. |
Data | Accepted or rejected cookie categories |
Originator | Lywand Software GmbH |
Privacy Policy |
Purpose | This web analytics tool allows us to compile user statistics about your website activity and to best tailor our website to your interests. |
Data | anonymized IP address, pseudonymized user identification, date and time of the request, amount of data transferred incl. message as to whether the request was successful, browser used, operating system used, website from which access was made. |
Originator | Google Ireland Limited |
Privacy Policy |
Purpose | Representation of the company's location using Google's map service. |
Data | Date and time of visit, location information, IP address, URL, usage data, search terms, geographic location. |
Originator | Google Ireland Limited |
Privacy Policy |
Purpose | Convenient appointment scheduling via Calendly directly on the website. |
Data | Appointment information, calendar information, information from third-party software providers, payment information, chatbot data, marketing information, log & device data, cookie data, usage data |
Originator | Calendly LLC |
Privacy Policy |
Purpose | This data processing is performed by YouTube to ensure the functionality of the player. |
Data | Device information, IP address, referrer URL, viewed videos |
Originator | Google Ireland Limited |
Privacy Policy |
How does ransomware work and what do you have to consider in order to protect yourself against it? We provide an overview of the answers to the most frequently asked questions.
The number of ransomware attacks has multiplied in recent years, and the trend is still rising. For companies as well as MSSPs, system houses and IT service providers, prevention and defence against ransomware attacks have top priority in their IT security strategy.
How does ransomware work, and what do you have to consider in order to protect yourself against it? We provide an overview of the answers to the most frequently asked questions.
The purpose of a ransomware attack is to digitally extort money from victims. The target can be a private individual with only one end device or a company with an extensive network infrastructure.
The extortion software is infiltrated into the victim's system and encrypts data stored there or blocks access to essential systems. Finally, a ransom is demanded, after which the victims are supposed to regain access to the hijacked data and system components. The payment has to be made in a cryptocurrency, which means that the criminals leave no traces.
For cybercriminals, a ransomware attack is a powerful lever, because the victims can hardly counter it. Decryption of the data that has been encrypted by ransomware is only possible to a very limited extent and is rarely successful.
The pressure of suffering on the part of the victims is therefore extremely high. If they are unprepared for a ransomware attack, this means losses and high costs for them. The attackers are aware of this, which is why they set the amount of the ransom comparatively low.
Since payment initially seems like the easiest solution, the victims' willingness to pay it – and thus the criminals' chances of success – is very high. Whether the victims really regain access to their data, however, is not guaranteed.
Digitisation and networking offer a growing pool of targets for attack
The costs for creating and distributing the software are low
High success rate even with broad-based ransomware campaigns
Ransom payments cannot be processed in a traceable manner
In the majority of cases, ransomware attacks are mass-produced goods for criminals. They make their profit from the sum of small ransom amounts from successful attacks.
Ransomware is extremely feared because a successful attack can cause massive damage on various levels. The immediate consequences of a successful attack are obvious:
Irreplaceable loss of company data
Business interruption and loss of revenue due to blocked critical IT systems
Costs for restoring or re-setting up IT systems
Depending on the case, there may be additional consequences:
Legal consequences in the event of loss of sensitive customer data, and even penalties
Media attention and negative headlines
Damaged corporate image and loss of trust among customers
Among cybercriminals, ransomware is an extremely lucrative business model. In order to make more profit from it, they have improved it in recent years and organised their capacities efficiently. This has given rise to a criminal market with specialised services that is experiencing sustained growth and whose development is worrying:
Low prices: The cost of a ransomware campaign has fallen due to mass availability. Distribution is possible with amounts as low as a few hundred euros.
Ransomware-as-a-service: Work steps for ransomware attacks are available as a service. Developers rent their software to "affiliates" who carry out the campaigns. They share the extortion money generated. Other service providers offer rentable botnets for the automated distribution of malware via emails.
Easy recruitment of new recruits: Powerful attack tools can simply be bought in, which represents a low barrier to entry into this type of crime.
The ransomware scene is therefore highly competitive. Its players are under pressure to constantly improve their services in order to be able to make profits in the future. Due to this progressive professionalisation, ransomware will continue to be a serious attack vector for companies in the future.
It is rather the exception that a single company is targeted for a ransomware attack. As a rule, these are mass campaigns that are spread in various ways:
Social engineering exploits typical human emotions, such as curiosity, helpfulness, fear, insecurity, boredom or shame, in the hope that victims' judgement will be restricted based on their emotional response. Cybercriminals try to appeal to victims' feelings in the email text – for example, by sending them supposed job applications – in order to immediately trigger a desired action.
Example of a classic phishing email
If the recipients fall for the e-mail bait and click on the link provided or open the prepared e-mail attachment, the attackers have been successful. The malware (payload) is reloaded, and the ransomware can spread in the system via the end device.
For drive-by infections, cybercriminals compromise the websites of serious providers. Accessing the website ensures that the ransomware injected there is downloaded and executed in the background. Malvertising works similarly, where criminals place an infected digital advertisement. All that is needed to execute the malicious code is either a click on the ad or a visit to the website where it is placed.
In order to be able to act effectively and increase the chances of success of their ransomware campaigns, cybercriminals are increasingly using exploit kits. Exploits refer to vulnerabilities in firmware and software that can be misused for malicious purposes. The exploit kits distributed via phishing, drive-by downloads or malvertising are programmes that automatically search for a multitude of vulnerabilities in a system.
Once they have discovered one or more of the vulnerabilities they are looking for, they reload the malware. The purpose of exploiting vulnerabilities is to allow cyber criminals to gain widespread access to the IT system as quickly as possible and to avoid early detection by antivirus software.
Vulnerabilities in IT systems can determine whether one falls victim to ransomware or not. For companies as well as IT service providers, MSPs, MSSPs and system houses, the best prevention is to increase the resilience of IT systems. This requires them to take action on several levels:
Developing recovery plans can significantly reduce vulnerability even in the event of a successful attack. As the last line of defence in the event of an emergency, contingency plans should cover the following areas:
Measures to contain the spread and protect systems not yet affected.
How should back-ups be carried out and secured to ensure that they are quickly available in the event of an emergency?
Under what conditions does a recovery make sense, and how should it proceed?
How do you save traces for later forensic analysis?
In everyday IT life, it is important to design the circumstances and processes of the IT system in such a way that the attack surface for ransomware remains as small as possible. Best practices in prevention include:
Segmented and isolated network topographies.
Use of a network detection and response (NDR) solution
Regular back-ups
Immediate application of available updates to all system components
Renewal of software and hardware with expired security support
Systematic patch and vulnerability management
Access control management
Two-factor authentication for cloud and web services
Disable unnecessary maintenance connections
Allow-listing of applications
Regular IT security training
The ongoing professionalisation of cybercrime means that the attack vectors are becoming increasingly specialised. Vulnerabilities that currently have little relevance for IT security can soon be exploited.
Maintaining an overview and being able to assess the extent to which security measures against ransomware are sufficient is becoming increasingly difficult. Lywand supports companies, IT service providers, MSPs, MSSPs and system houses in reliably auditing IT environments.
Lywand's security audit platform has a separate rating category of ransomware protection. The rating scale of A-F represents at a glance the susceptibility of the IT environment to a ransomware attack.
For this purpose, technical properties such as the up-to-dateness of installed software and antivirus protection, the state of the firewall, web traffic and email security as well as macro security are automatically checked.
Overview of subcategories that are reviewed by lywand
Non-technical requirements, such as back-up routines and security awareness, are collected via questionnaires and are included in the assessment.
Questionnaire on back-ups on the basis of which measures are then created
From this, the platform develops an individual catalogue of measures with which the IT security situation can be improved and the protection against ransomware attacks can be increased.
Example renovation plan with ransomware measures
In a demo session, we will give you a live tour of the lywand security audit platform. We will show you the most important features and discuss with you which application scenarios arise for you and how you can optimally benefit from lywand.
Guide
System hardening is an essential process for protecting your customers' IT infrastructure. But what exactly is system hardening and why is it so important?
Feature
As part of our security audits, compliance with CIS benchmarks is now also displayed. Read the article to learn more about this new feature and the added value it provides.
Guide
This article highlights the differences between the traditional IT service model and the Managed Service Provider (MSP) approach. It explains the advantages of the MSP approach and how the transition from a traditional IT service provider to an MSP can be successfully managed.