Time is of the essence

Issue 8 2023 Information Security

Ransomware attacks do not happen instantly. It is not one malicious link and then lockdown. Instead, attacks can be years in the making, from initial observations and break-ins to declaring the ransom. For example, reports suggest Clop may have been sitting on its MOVEit exploit as far back as 2021. So, what is the timeline of a ransomware attack, and why must businesses understand this to improve their ransomware resilience?

Understanding the attack timeline

It is a common misconception that ransomware attacks happen out of the blue. Cybercriminals often like to take their time, taking the scenic route through your business and getting to know it inside out.

The ransom stage is the only part of the process that is visible. This is when attackers announce their presence, but as highlighted by investigations into this year’s MOVEIt hack (the biggest hack of 2023 so far), they can spend years behind the scenes. So, what is happening in the lead-up to the ransom demand?

First, attackers start with an observation stage. This time is spent gathering as much information as possible on the target organisation, including its people, processes, and technology. This could take months. After enough intel has been gathered, attackers will move to infiltrate their target’s system, gaining access through a preliminary attack, commonly a phishing email.

After establishing entry, attackers will set up camp within the organisation’s IT infrastructure, creating a base of operations from which they can elevate their access and make lateral movements. At this stage, they do some of the most significant damage, snooping around undetected and compromising identified high-value targets. They can take their time over this, making as many moves as possible to ensure maximum exploitation.

After this, attackers spend time crippling recoverability. This involves altering backup routines, documentation, and security systems to reduce or completely deny restore capabilities. So, before the organisation is even aware of the attack, it is too late to turn to its backup. Things are heating up at this stage, finally coming to a head with the declaration of ransom. As well as announcing their presence and making demands, cybercriminals at this final stage will encrypt their victim’s data and wipe all records and backups. This entire process might unfold over a year or even multiple years.

Making your backup bulletproof

The discovery that malicious actors can inhabit your systems unseen for a year or more while you are none the wiser can be daunting for businesses. But it is crucial knowledge and never fails to create a sense of urgency when implementing a robust data security strategy. Every minute your business passes without this in place is another minute cybercriminals can carry out the groundwork that will later cause much pain.

So, armed with this knowledge, what steps do businesses need to take? The biggest concern is the usability of backups for recovery after an attack. Suppose your system was breached a year ago without your knowledge. In that case, there is a very high likelihood that your backups are impacted, meaning you will try to restore your data using a compromised backup. Fortunately, this can be avoided with the proper preparation and the right backup strategy in place.

Getting hit by a ransomware attack is almost inevitable for the modern enterprise, with 85% of organisations experiencing at least one cyber-attack in 2022, nearly 10% more than the previous year. Moreover, as cybercriminals increasingly target backups, the road to recovery can be longer than ever.

Thinking of ransomware attacks as a case of ‘when’, not ‘if’, means recognising that you will need to use your backup to restore your critical data when the time comes. Acknowledging this should spur businesses to invest serious time and resources to ensure their backups are ironclad.

This is possible by following the golden rule of backup: 3-2-1-1-0. This requires three copies of data stored on two different media, one stored off-site and one air-gapped and immutable. Across these copies, there needs to be zero errors. Working under the assumption that cybercriminals will target your backup means taking precautions so you retain at least one untouched copy to use for your recovery. It is like keeping your money in a bank and making copies of essential documents in case your house gets robbed – thieves will target your safe, so storing valuables offsite and making copies provides peace of mind.

Implementing a 3-2-1-1-0 backup strategy isn’t a one-time thing. You must constantly monitor and test your backups, checking for errors and cleaning your data as needed. Cybercriminals rely on businesses not doing this; you can stay one step ahead by remaining strict on your data strategy.

Controlling the chaos

Ransomware is a disaster, and disaster recovery takes time. According to the latest Veeam Ransomware Trends Report, most businesses take at least three weeks to recover from a ransomware attack. It is important to note that this recovery time starts after the company has triaged. This investigative stage can be extensive, and its impact on recovery timelines is hard to predict and overstate. At this stage, the business needs to identify the attack's source and the damage's extent; they may even face yellow tape if government bodies need to drive the investigation.

During this time, the business is still compromised. In the worst-case scenario, it might have been forced to cease operations entirely while the breach is investigated and resolved. It is not making money if it is not operating. Worse than this, costs are spiralling as it is resource-intensive to recover from a large-scale attack, with IT departments and key stakeholders working round the clock, and there are legal fees and compensation costs to account for, as well as reputational damage.

It is hard to predict how long a recovery process will take because ransomware is a disaster with a difference. Suppose you are recovering from a natural disaster like a fire. In that case, you can trust your last known backups or replicas and use them to begin recovery immediately, safely knowing that the backups have not been interfered with. This is not the case with a cyber-disaster, which considerably lengthens recovery time. It takes time to identify which servers are infected and to determine whether backups and replicas are also affected (if they are, they can reintroduce the ransomware to your infrastructure, sending you right back to square one).

However, while ransomware is a severe threat and can potentially cause widespread damage, there are measures businesses can take to reduce the recovery time and the extent to which they can be compromised. As mentioned, the golden 3-2-1-1-0 backup rule is a critical tool in your arsenal. While ransomware attacks are inevitable and backups increasingly targeted, by implementing a robust data backup strategy, you always have a clean copy of your data to fall back on.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Access & identity expectations for 2024
Technews Publishing IDEMIA ZKTeco Gallagher Salto Systems Africa Regal Distributors SA Reditron Editor's Choice Access Control & Identity Management Information Security AI & Data Analytics
What does 2024 have in store for the access and identity industry? SMART Security Solutions asked several industry players for their brief thoughts on what they expect this year.

Prepare for cyber-physical attacks
Gallagher Information Security Access Control & Identity Management
As the security landscape continues to evolve, organisations must fortify their security solutions to embrace the changing needs of the security and technology industries. Nowhere is this more present than with regard to cybersecurity.

Zero Trust and user fatigue
Access Control & Identity Management Information Security
Paul Meyer, Security Solutions Executive, iOCO OpenText, says implementing Zero Trust and enforcing it can create user fatigue, which only leads to carelessness and a couldn’t care attitude.

Passwordless, unphishable web browsers
Access Control & Identity Management Information Security
Passkey technology is proving to be an easily deployed way to bring unphishable, biometric-based security to browsers; making identification and authentication much more secure and reliable for all parties.

All aspects of data protection
Technews Publishing Editor's Choice Information Security Infrastructure AI & Data Analytics
SMART Security Solutions spoke to Kate Mollett, Senior Director, Commvault Africa, about the company and its evolution from a backup specialist to a full data protection specialist, as well as the latest announcements from the company.

The song remains the same
Sophos Information Security
Sophos report found that telemetry logs were missing in nearly 42% of the attack cases studied. In 82% of these cases, cybercriminals disabled or wiped out the telemetry to hide their tracks.

How hackers exploit our vulnerabilities
Information Security Risk Management & Resilience
Distractions, multi-tasking, and emotional responses increase individuals’ vulnerability to social engineering, manipulation, and various forms of digital attacks; 74% of all data breaches included a human element.

Projections for 2024’s Advanced Threats Landscape
News & Events Information Security
Kaspersky Global Research and Analysis Team (GReAT) experts offer insights and projections for 2024 in the Kaspersky Security Bulletin, with a focus on the evolution of Advanced Persistent Threats (APT).

Veeam and Sophos in strategic partnership
Information Security
Veeam and Sophos unite with a strategic partnership to advance the security of business-critical backups with managed detection and response for cyber resiliency, and to quickly recover impacted data by exchanging critical information.

Unmasking insider risks
Information Security
In today’s business landscape, insider risks can manifest in various forms, including data theft, fraud, sabotage, insider trading, espionage, whistleblowing, negligence, truck hijacking, goods robbery from warehouses, and more.