Detecting and Responding to Ransomware and Other Destructive Events
No organization is immune from cybersecurity threats and
attacks, which can range from minor inconveniences to major
catastrophic events that may take months sometimes years
to overcome.
Events such as ransomware, destructive malware, insider threats, and even honest mistakes, can threaten an organization’s infrastructure, not to mention its most valuable asset—its reputation. Moreover, database records and structures, system files, configurations, user files, application code, and customer data are all at risk should an event occur.
Cyber threats are not abating, rather they are increasing and becoming more complex, pervasive, and damaging. Organizations that lack detection and response solutions are highly vulnerable to any number and types of data integrity events. This project aspires to assist organizations with addressing this challenge.
Organizations can reduce the likelihood of such events by implementing a cyber defense strategy that includes maintaining awareness of organizational assets, identifying and mitigating potential attack vectors, making backups, and generally implementing procedures prior to an attack to ease detection, response, and recovery.
Data Integrity Challenge
The process of mitigating an active attack on an organization’s data integrity requires the use of stronger, more effective tools. Detection of a data integrity attack involves the identification of its source, the affected systems, and sufficient data collection to allow for impact analysis.
Compromise can come from malicious websites, targeted e-mails, insider threats, and honest mistakes. Once detected, swift response to a threat is critical to mitigate the need for recovery action after an event occurs.
Typical responses to active attacks can involve various forms of mitigation, such as network quarantining or account management.
Forensics can be used to determine the impact of an attack, and analysis allows the organization to learn and improve their defenses. The implementation of these defenses allows an organization to monitor their systems for the signs of an attack and respond appropriately
Creating a cyber defense strategy requires a combination of technical expertise, time, and resources, which are often scarce in small- and medium-size organizations. For instance, the first step in building a strategy requires an organization to inventory its assets. This involves identifying systems, applications, data sources, users, and other relevant entities and also identify vulnerabilities within these assets that may enable them to become targets or facilitators of data integrity attacks. Once this exercise is complete, an organization can then create a customized strategy to protect the identified assets against the possibility of data corruption, modification, and/or destruction.
Data Integrity Benefits
By having a cyber defense strategy in place, organizations can:
- become aware of data integrity events as they occur
- analyze, mitigate, and then contain data integrity events
- minimize any impact on worker productivity
- reduce or avoid financial and reputational damage
- develop an inventory solution
- baseline systems prior to an attack
- protect assets against attacks
- protect its data/infrastructure
- identify and analyze vulnerabilities prior to an attack
- build a maintenance solution to manage software versioning and patch distribution
Data Integrity Solutions
Solutions include, but are not limited to:
- inventorying
- file integrity monitoring
- backups
- secure storage
- auditing
- vulnerability management
- system maintenance solutions
Data Integrity Methods
- integrity monitoring
- event detection
- malicious software detection
- unauthorized activity detection
- anomalous activity detection
- logging and data correlation software
- reporting capability
- vulnerability management
- forensics/analytics tools
- mitigation and containment software
Learn more