Ransomware has taken the world by storm this year, costing millions for businesses around the world. In the last 12 months alone, the number of ransomware variants spotted in the wild has more than doubled. As its prevalence has increased, so has the complexity of the attacks, and new ways to defend against them have been developed. Microsoft have been known to take the ransomware threat very seriously, even releasing a security patch for the long obsolete Windows XP operating system in the wake of the infamous WannaCry attack back in May. With the realease of the Windows 10 Creators Update (build 1703), now there are even more features built right in to the OS that can prevent and protect against ransomware. In fact, it’s so secure that Microsoft claim no Windows 10 devices were affected by WannaCry.
“Spear phishing is an email or electronic communications scam targeted towards a specific individual, organisation or business. Although often intended to steal data for malicious purposes, cybercriminals may also intend to install malware on a targeted user’s computer.”
Gone are the days when the only phishing threats were from poorly spelled emails asking you to claim Clubcard points. With the cybercrime-as-a-service (CaaS) industry estimated to be worth in the billions each year, cyber criminals are becoming increasingly organised in the way they implement their attacks. Instead of sending out random emails and hoping for the best, spear-phishing involves researching a particular organisation, probing for weaknesses, then sending highly targeted, personal phishing emails. These emails may appear as if they come from your CEO, or IT manager, or even the colleague that sits next to you. It is estimated that over 90% of successful data breaches by cyber criminals started with a spear-phishing attack. The best means of prevention is to implement an ongoing cyber security awareness program, as trained staff can detect and block spear phishing attacks before it’s too late.
Back in May, the world saw a global ransomware attack on a then-unprecedented scale – WannaCry. This cyber attack affected more than 230,000 computers in more than 150 countries, and is estimated to have cost businesses up to $4 billion. To say that businesses were caught off-guard is an understatement, with the malware utilising vulnerabilities in the long-obsolete Windows Server Message Block (SMB) v1 and through computers with out-of-date Windows security patches. It gets onto a network most often through human error – employees clicking phishing emails – then spreads like wildfire to other machines that are connected to the internet.
This week, however, reports came in from Ukraine and across Europe that a new mass-ransomware attack was underway. Initially theorised to have been a variant of WannaCry, cyber security experts now believe it to be a variant of Petya, a strain first seen in 2016 which was then predicted to be “the next step in ransomware evolution”.
Oops, your important files are encrypted. There is currently no known way to recover files affected by Petya.
Japanese carmaker Honda released a statement last Tuesday that it had halted operations in its Sayama, Japan car plant due to a recurrence of the now-infamous WannaCry ransomware. The plant, which has an output of approximately 1000 vehicles per day, was shut down on Monday after Honda discovered the virus had affected networks across Japan, North America, Europe, China and other regions. This was despite attempts by the company to secure its networks against such attacks when the initial WannaCry outbreak occurred back in May.
Just one day’s downtime at Honda’s Sayama plant cost production of 1000 vehicles
With the introduction of the new EU general data protection regulation (GDPR) this time next year (25 May 2018 to be exact) – businesses all over the globe could find themselves in breach of the regulation and facing hefty fines should they fail to prevent a ransomware attack, phishing attack or similar. The message is finally getting out there – something needs to be done about ransomware and fast.
How Ransomware could cause a breach of GDPR?
As noted in this RTE article by @AengusCox – data protection and governance expert @DaraghOBrien, Managing Director of Castlebridge Associates, confirms GDPR is all about accountability. Not only do organisations have to comply with the regulation, they also have to demonstrate compliance through evidential proof (documentation, etc) of the controls, processes, technology, etc. that they have in place to protect the sensitive and personal data they hold on EU citizens (to include their staff, customers, vendors and third parties).
Daragh confirms that ransomware could indeed be seen as a breach of GDPR by the data protection commissioner, as ransomware typically can affect both the availability and access of personal data and can also affect the recovery of the personal data. Indeed, some viruses are known to upload personal data to hackers – a clear data breach and major breach of the GDPR.
As the GDPR comes more and more into focus through the year and into next year – security experts predict that hackers/scammers will begin to steal data with advanced ransomware and then blackmail the victims by threatening to report them to data protection commissioner.
What can be done?
In the RTE video interview, Daragh notes that security awareness training for staff is crucial now. Businesses urgently need to train their staff how to recognise and avoid clicking on links in phishing emails.
Many may not realise yet, but Article 39 1(b) of the GDPR regulation places a mandatory onus on organisations to undertake security awareness training for staff that deal with sensitive personal data. Read more