Hello there, and thanks so much for clicking on the video today.
My name is Bradley Knapp with IBM Cloud, and the question we are here to answer today
is a pretty basic one, but it's one that is very timely. It's been in the news a lot lately.
And that question is..
..what is ransomware?
Been in the news.
Right between various attacks against things like the Colonial Pipeline,
attacks against local governments, school systems, police departments,
city halls, public schools.
Ransomware is everywhere in the news.
And the question of course is, what is this ransomware thing?
What is it? How does it matter? How can I protect myself against it?
This is a question that needs to be on the mind of every corporate IT employee in the world.
Additionally, you need to worry about it for home machines too.
Ransomware knows no boundaries. You are equally vulnerable to it on a home PC
as a corporate internet is on their internet.
So, let's talk about first, what is it.
At it's most basic, the idea behind ransomware is you have a computer of some kind, right.
And so, we got a computer. We got a little monitor on it.
We got our little keyboard, right.
Got our keys on the keyboard.
And our keyboard is humming along, right. We are doing our computer things.
Doing everything that we need to.
And, in the operating system there are always going to be security vulnerabilities of various kinds.
It's just inherent to computing. We are never going to find every bug.
The best we can do is as we find bugs we fix them.
But...these security vulnerabilities can be exploited, right.
There are large groups of malicious actors out there that are constantly scanning, looking at code,
looking for these vulnerabilities, looking for the ability to access systems.
So...
...when one of these vulnerabilities is discovered what a malicious actor will do is they will figure out,
alright, first of all, is this protected against. If it's not protected against, how can I exploit this?
How can I use it to make money?
Because at the end of the day these malicious actors, most of them are not doing it for fun,
they're doing it to get paid.
So, what do they do?
They take that vulnerability in your machine and they're going to transmit some software
over the internet into the machine. And then that software is then going to sit dormant and idle
until it gets executed. And so, it may have a time delay of a day, a week, a month, whatever.
But there will be some sort of time delay between when the malicious actor accesses the machine
and when that code executes.
Now, what happens when the code executes?
The answer is that code is going to encrypt a very large proportion of the files on the machine.
Now, what is not going to encrypt?
It doesn't encrypt the core operating system files because if it does the second part will not work.
So it's going to encrypt all of the data that is not necessary to boot the machine up and get it running.
So, if it's a Windows machine it's going to encrypt everything that is not in the Widows directory.
It's going to encrypt all of the games, all the spreadsheets, all of the files, all of the pictures, all of the everything on that machine.
And then, it's going to pop up something on the screen. It's going to say "you've been hacked."
"You've been owned."
Your machine is compromised. And the only way to get your data back is to pay a ransom,
that's the ransom part of ransomware,
to the malicious actor that has encrypted your machine.
That ransom is almost always paid via a cryptocurrency of some kind that has to be transferred to the attacker's wallet.
And, so what I just described is how it works on a consumer grade machine,
but frankly everyone, it's exactly the same thing on a server or on a fleet of servers.
So again, malicious actors scanning for code vulnerabilities, they're looking for problems.
The difference being since it is not a consumer level machine, they are in servers themselves.
So they are first looking for holes in your network security.
And then once they can get around your network, or if they find machines that are directly exposed to the public internet,
then they are scanning for vulnerabilities on the machines themselves.
Again they are looking for that exploit that nobody knows about.
But, let's be very honest here,
the incidents of attacks using a zero day, or a previously unknown exploit are actually really, really, really small.
The vast majority of these malicious actors are not using zero day exploits.
They are using exploits that have been known. Sometimes they are exploits that have been known for months or years.
And so we are going to talk about remediation over here. Keep this point in mind because its a very important one.
But, back to our compromised systems, so we are over here. We got, you know,
one, or two, or ten, or fifteen different servers.
The servers have been compromised, the malicious actor has spread though the network. He's gotten access to
a number of servers and he has installed the ransomware. And the only way to get any of that data back
again it to pay the ransom. You know have to pay the guy in hopes he will send you the decryption tool
that you need in order to get your data back.
Now, as to whether or not you pay the ransom no one can answer that question for you.
Hopefully you have sufficiently prepared yourself that you never experience this to begin with.
But if you do experience it, only you can answer the question if I pay the ransom or not.
Now, there are ways to avoid it and that is what we are going to talk about next.
So, you have been owned, worst case scenario.
Now let's get into how do we keep ourselves safe.
Alright. So, in order to avoid letting those malicious actors, letting those hackers get access to your system.
The first and most important thing you can do is have good network policies.
It all comes down to the network.
This includes both your home network, and any kind of enterprise or commercial network.
If you're network is properly setup, it is configured. If you are regularly installing all of the patches
and all of the firmware upgrades in order to keep your network equipment up and running safely.
That is your first line of defense against any malicious actor getting into your machine.
Second line of defense. Once you get to the physical machine itself, so let's get to our, you know server here.
You must follow proper security protocols and practices to secure your servers.
This is so, so, so important. And this goes beyond just user access control.
Although obviously user access control is incredibly important.
Please do not ever use default passwords for anything. Please always use secure passwords.
If you must use a password, use keys if all possible. A key management system is superior to a user password
in every possible manner.
In addition to using keys, you must keep your machines updated.
Software patches, hardware or firmware patches are constantly being released.
They are protecting you against these malicious vulnerabilities.
And like we talked to a minute ago, the majority of these bad actors are using exploits that have been known for a while.
If you are on the enterprise side, if you are not regularly checking the CVE for vulnerabilities
in the systems your run on a regular basis,
you have got to add that to your best practice. You've got to do that on a regular basis.
If you do not have the time, or money, or the staff to do it on your own, please engage with a vendor
that is going to be constantly checking your systems, all of the operating systems,
and as much of the software you run against that CVE list.
You have to be checking it, and you have to be getting things updated.
Just because it's annoying to be taking some down time to update firmware, and update software
on those servers doesn't mean you can ignore it. Don't put it off. You have to keep these things modern and current.
Don't run old versions of operating systems.
And if you absolutely have to run an old version of an operating system,
air gap the system.
Make it impossible to access that system from the public internet.
It is not safe to leave old window machines connected to the internet, they will be compromised.
There is just no other way around it.
So please, use modern hardware, use modern software.
Keep all of your security patches and your firmware patches up to date.
Next piece. Let's assume that you have a malicious actor that is a little better than most
and they have found a zero day vulnerability, a previously undisclosed vulnerability. One that is not yet on the CVE list.
And this is one of the more interesting topics, you must backup your machines.
Now...
..backup and restore is not the most fun thing to do on the planet. As a matter of fact there is nothing fun about it.
But if you are not regularly testing your backups for your ability to restore from them,
you don't have a backup strategy.
You must test those backups all the time. Once a year is not often enough.
These backups are your only way to get back up and running if you've been compromised.
It's the only way you're going to get back up without having to pay ransom.
If you're a home user, the backups are how you are going to get your photos back.
I mean just frankly, you're going to lose whatever has been compromised
whether you pay that ransom or not in many cases because the decryption tool may not work.
Or this malicious actor may just not care, they may just take the money and run.
They have no obligation to provide you with what you paid for. Again, they're criminals.
This is how they get started in the first place.
So, have a backup strategy. Have a restore strategy.
Have a good network map of all your systems and their inner connections.
Because if someone can compromise one server, they can probably compromise multiple.
And so, let's imagine here our enterprise network, right.
So we've got server here one. And we've got, you know, an active server directory over here.
And we've got servers, you know, three, four, five, six, seven, whatever and so on and so forth.
Everything is all inner connected, right. Active directories going to get all of the controls.
Let's say that the server that gets compromised is your active directory server.
This is kinda like worst case scenario stuff here. Once they are in your active directory server if the can get some credentials
they can start to get into everything else that you have running in your environment.
They are going to compromise everything.
And so, once they have compromised it, once they have encrypted everything,
they've sent you their ransom message.
You then have to make the decision, alright, are we going to try to restore from a backup.
Well, remember at the beginning when I said that the malicious actor, they were going to install code,
but they weren't going to trigger it yet.
Do you know when you were compromised.
Because you have to restore to a backup before you were compromised.
Because if you restore a backup, you're backup strategy is great, you've got good systems images,
you can bring everything backup from a backup from last week. But oh wait, you were compromised six weeks ago.
All you're going to do is restore good backup copies that still have the malicious code in them.
And if that is the case, do you have the ability to find that malicious code and eliminate it
before it activates itself again.
Otherwise you are going to find yourself in exactly the same spot.
No access to systems, no ability to process workloads, no ability to run applications, you are down.
So, that is what ransomware is. These are some ways to protect against it.
Please, please, please, I implore you, learn about ransomware. Learn how to protect yourself against it.
Engage companies that have expertise, you know, folks that know a lot about the CVE.
Folks that know a lot about network security, that know about server security.
Engaged with your operating system vendors to be sure you are on a regular patch and maintenance cycle
to be sure you are protecting yourself against these kind of attacks.
Hopefully you found the information today valuable. If you have any questions, please feel free to leave them in the comments.
And we will talk to you later.
Thank you so much for stopping by the channel today.
If you have any questions or comments, please feel free to share them with us below.
If you enjoyed this video and you'd like to see more like it in the future, please do like the video and subscribe to us
so we'll know to keep creating for you.