[BreachExchange] CISA shares guidance on how to prevent ransomware data breaches

[Sophia Kingsbury]

https://www.bleepingcomputer.com/news/security/cisa-shares-guidance-on-how-to-prevent-ransomware-data-breaches/

The US Cybersecurity and Infrastructure Security Agency (CISA) has released
guidance to help government and private sector organizations prevent data
breaches resulting from ransomware double extortion schemes.

CISA's fact sheet includes best practices for preventing ransomware attacks
and protecting sensitive information from exfiltration attempts.

The federal agency issued these recommendations in response to most
ransomware gangs using data stolen from their victims' networks as leverage
in ransom negotiations under the threat of publishing the stolen info on
dedicated leak sites.

"Ransomware is a serious and increasing threat to all government and
private sector organizations, including critical infrastructure
organizations," CISA said.

"All organizations are at risk of falling victim to a ransomware incident
and are responsible for protecting sensitive and personal data stored on
their systems."

How to block ransomware and protect data

CISA encourages organizations to implement recommendations shared in the
info sheet published on Wednesday designed to streamline the process of
preventing and responding to ransomware-caused data breaches.

Among the advice included to prevent ransomware attacks, CISA says that
at-risk orgs should:

   - Maintain offline, encrypted backups of data and regularly test backups
   - Create, maintain, and exercise a basic cyber incident response plan,
   resiliency plan, and associated communications plan
   - Mitigate internet-facing vulnerabilities and misconfigurations to
   reduce the attack vector
   - Reduce the risk of phishing emails from reaching end users by enabling
   strong spam filters and implementing user awareness and training programs
   - Practice good cyber hygiene (use up-to-date anti-malware solutions and
   application allowlisting, enable MFA, and limit the number of privileged
   accounts)

To block ransomware gangs from gaining access to customer or employee
sensitive or personal information, CISA recommends:

   - Implementing physical security best practices
   - Implementing cybersecurity best practices (don't store sensitive data
   on Internet-exposed devices, encrypt sensitive info at rest and in transit,
   use firewalls, use network segmentation)
   - Ensure your cyber incident response and communications plans include
   response and notification procedures for data breach incidents

Additional info on how to defend against and respond to ransomware attacks
is available in the fact sheet and on CISA's recently launched
StopRansomware.gov web portal.

Ongoing effort to fend off the escalating ransomware threat

CISA's ransomware data breach guidance follows an almost continuous barrage
of ransomware attacks targeting the US public and private sectors in recent
years.

For instance, the networks of Colonial Pipeline, JBS Foods, and Kaseya
customers were hit in a string of ransomware attacks within just two months.

Since December 2019, CISA has issued multiple warnings to private industry
partners, starting with info on LockerGoga and MegaCortex targeting
worldwide organizations and a ransomware attack against a US natural gas
compression facility, part of the critical US infrastructure sector.

Earlier this month, CISA announced the Joint Cyber Defense Collaborative
(JCDC) partnership across public and private sectors focused on defending
critical infrastructure from ransomware and other cyber threats.

The federal agency also released a new ransomware self-assessment security
audit tool in June to help at-risk organizations understand how well
they're equipped to defend against and recover from ransomware attacks
targeting their information technology (IT), operational technology (OT),
or industrial control system (ICS) assets.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20210820/4d84f301/attachment.html>