Ransomware continues to torment financial services (finserv) organizations around the world. More than 55 percent of finserv organizations were hit by ransomware attacks in 2021, according to Sophos' State of Ransomware in Financial Services 2022 Report — a substantial increase from 34 percent in 2020. These attacks threaten to shut down business by burning through resources and exposing extremely sensitive customer data like Social Security numbers.
Attackers know that ransomware is incredibly easy to execute and scale, and new digital payment methods such as cryptocurrencies make it easy to hide identities and bury a paper trail — all of which has put finserv security departments on alert. According to Boston Consulting Group, finserv organizations are 300 times more likely to be targeted by a cyberattack.
The surge in these attacks can be attributed to multiple factors:
Preventing ransomware requires that finserv organizations shift from a traditional detect-and-respond approach to a Zero Trust mindset. This proactive, preventative approach safeguards mobile, distributed, and often unmanaged endpoints; stops the lateral spread of attacks on the network; and alleviates pressure on Security Operations Center (SOC) teams.
In addition, finserv organizations can provide a boost to their security via isolation technology, which can act as an abstracted layer in the cloud between the Internet and users’ devices. All content is routed through the Secure Web Gateway (SWG), where it is executed in an elastic sandbox in the cloud. This prevents all code — whether malicious or not — from executing on endpoints, effectively cutting off any access a malicious actor has to the network. Given that many of us now spend around three-quarters of our day using a web browser, isolation can also protect users against HEAT attacks from delivering malicious payloads. All web communication can be authenticated in the moment, enabling a Zero Trust approach to security that protects devices, applications, and users wherever they are located.
Here are three ways that Zero Trust powered by isolation technology can help stop ransomware attacks:
Ransomware loves to take advantage of vulnerabilities in existing network configurations, such as open RDP ports and unsecured VPNs. Unfortunately, the expansion of attack surfaces means that it is virtually impossible for security teams to completely close off these entry points. They are too numerous, too distributed, and too often forgotten. With isolation technology, however, it doesn’t matter if these ports are closed or not, because all traffic — whether it is suspicious or not — is routed through the isolation layer in the cloud. Traffic is never executed on the endpoint, and therefore ransomware cannot grab a foothold into the network.
Routing all traffic through an abstracted layer in the cloud gives finserv organizations the visibility they need to identify and stop abnormal behavior that, on the surface, may seem innocuous. For example, a user with the appropriate credentials should be able to access financial information on a server. But what if the user is logging in from Albania? Or what if they are attempting to download the entire payroll database to an unknown Google drive? Visibility into entities, where they are located, and the commands they are executing enable a Zero Trust approach to cybersecurity.
Most ransomware relies on the fallibility of humans. Someone has to click on a link. Someone has to visit a corrupted website. Someone has to enter their credentials into a false web form. When mistakes happen, it’s critical that the organization has a recovery plan in place to assess the situation and determine the next best action. Answering questions such as “Can we recover lost data?”, “How will this impact operations?”, “Are we vulnerable anywhere else?”, and, most importantly, “Should we pay the ransom?” requires context and visibility into the network. Isolation technology makes this possible.
Ransomware is a top concern among finserv organizations today, and it will continue to vex their security teams in the future especially as HEAT attacks continue to gain popularity among attackers. Taking a Zero Trust approach to security powered by isolation technology provides the best defense against these often-successful and disruptive attacks.