Ransomware continues to torment financial services (finserv) organizations around the world. More than 55 percent of finserv organizations were hit by ransomware attacks in 2021, according to Sophos' State of Ransomware in Financial Services 2022 Report — a substantial increase from 34 percent in 2020. These attacks threaten to shut down business by burning through resources and exposing extremely sensitive customer data like Social Security numbers.
Attackers know that ransomware is incredibly easy to execute and scale, and new digital payment methods such as cryptocurrencies make it easy to hide identities and bury a paper trail — all of which has put finserv security departments on alert. According to Boston Consulting Group, finserv organizations are 300 times more likely to be targeted by a cyberattack.
The surge in these attacks can be attributed to multiple factors:
- Finserv organizations are at greater risk.
Finserv organizations hold some of the most sensitive data on the planet, and they have some of the largest budgets to pay out ransoms if need be. Threat actors are well aware — that’s why finserv was the second most attacked industry in 2021, according to IBM’s X-Force Threat Intelligence Index 2022. - Ransomware is more targeted than ever before.
Threat actors no longer have to rely on the inefficient “spray and pray” approach. Instead, they take a much more hands-on approach by creating an attack plan against a specific target. Social engineering allows them to gather volumes of data on specific targets and craft personalized content to entice a user or a group of users to click on a malicious link or download a malicious attachment. - Ransomware can hide in plain sight.
Today’s ransomware attacks are sophisticated and evasive, leveraging seemingly innocuous technologies such as Java communications and VPNs to spread laterally throughout the network. Threat actors are targeting web browsers with a new category of threats, termed Highly Evasive Adaptive Threats (HEAT), which bypass traditional security defenses. These HEAT attacks can be used to deliver ransomware payloads and take advantage of today’s expanded attack surfaces — created largely by the distributed workforce, the modernization of apps, and the spread of Software as a Service (SaaS) platforms — and they excel at bypassing traditional security solutions by hiding in plain sight. - Ransomware is extremely lucrative.
Threat actors aren’t content with small payouts anymore. Ransom payments more than doubled for finserv organizations in 2021, from $128,000 to $273,000 as the ransomware problem continued to grow in sophistication and frequency, according to Sophos. Unfortunately, the willingness of finserv organizations to pay large ransoms has created a self-perpetuating cycle. The more they pay, the more lucrative the attacks will be, attracting more criminals to the seemingly easy payoff. - The ransomware risk never goes away.
Once you’ve been infected, the risk of being exploited again never goes away. Threat actors aren’t satisfied with just keeping you out of your data or systems. They also request additional payments by threatening to expose sensitive data to the public or competitors. These are called double-extortion attacks, and the threat of getting hit again and again by the same event means that you are never really safe — even if you give in to ransom demands.
How to prevent ransomware
Preventing ransomware requires that finserv organizations shift from a traditional detect-and-respond approach to a Zero Trust mindset. This proactive, preventative approach safeguards mobile, distributed, and often unmanaged endpoints; stops the lateral spread of attacks on the network; and alleviates pressure on Security Operations Center (SOC) teams.
In addition, finserv organizations can provide a boost to their security via isolation technology, which can act as an abstracted layer in the cloud between the Internet and users’ devices. All content is routed through the Secure Web Gateway (SWG), where it is executed in an elastic sandbox in the cloud. This prevents all code — whether malicious or not — from executing on endpoints, effectively cutting off any access a malicious actor has to the network. Given that many of us now spend around three-quarters of our day using a web browser, isolation can also protect users against HEAT attacks from delivering malicious payloads. All web communication can be authenticated in the moment, enabling a Zero Trust approach to security that protects devices, applications, and users wherever they are located.
Here are three ways that Zero Trust powered by isolation technology can help stop ransomware attacks:
1. Isolation automatically closes vulnerabilities.
Ransomware loves to take advantage of vulnerabilities in existing network configurations, such as open RDP ports and unsecured VPNs. Unfortunately, the expansion of attack surfaces means that it is virtually impossible for security teams to completely close off these entry points. They are too numerous, too distributed, and too often forgotten. With isolation technology, however, it doesn’t matter if these ports are closed or not, because all traffic — whether it is suspicious or not — is routed through the isolation layer in the cloud. Traffic is never executed on the endpoint, and therefore ransomware cannot grab a foothold into the network.
2. Isolation helps detect abnormal behavior.
Routing all traffic through an abstracted layer in the cloud gives finserv organizations the visibility they need to identify and stop abnormal behavior that, on the surface, may seem innocuous. For example, a user with the appropriate credentials should be able to access financial information on a server. But what if the user is logging in from Albania? Or what if they are attempting to download the entire payroll database to an unknown Google drive? Visibility into entities, where they are located, and the commands they are executing enable a Zero Trust approach to cybersecurity.
3. Isolation allows you to execute a recovery plan.
Most ransomware relies on the fallibility of humans. Someone has to click on a link. Someone has to visit a corrupted website. Someone has to enter their credentials into a false web form. When mistakes happen, it’s critical that the organization has a recovery plan in place to assess the situation and determine the next best action. Answering questions such as “Can we recover lost data?”, “How will this impact operations?”, “Are we vulnerable anywhere else?”, and, most importantly, “Should we pay the ransom?” requires context and visibility into the network. Isolation technology makes this possible.
Take action today
Ransomware is a top concern among finserv organizations today, and it will continue to vex their security teams in the future especially as HEAT attacks continue to gain popularity among attackers. Taking a Zero Trust approach to security powered by isolation technology provides the best defense against these often-successful and disruptive attacks.