How to Detect Ransomware

Thanks to Dr. Jim Angle, Michael Roza, and Vince Campitelli

Once you know what ransomware is and how to protect your organization against it, it’s important to learn how to respond if a ransomware attack occurs. The first step: detecting the ransomware attack!

The Detect Function of the National Institute of Standards and Technology (NIST) Cybersecurity Framework provides an organization with the ability to detect events as they happen. This can be achieved through a combination of mechanisms, depending on the organization’s needs. In this blog, we’ll provide some brief suggestions.

Endpoint Security

You cannot assume that having the latest antivirus software will protect your systems against ransomware. The endpoint security should consist of antivirus, anti-malware, and anti-ransomware protection. Protection from all three is necessary to ensure that the endpoints are fully protected.

Advanced endpoint protection solutions can “learn” to identify malicious files and activity based on the attributes of known malware. Continuous monitoring of user and endpoint activity helps protect against malicious behavior by matching a stream of activity records against a set of dynamically updated attack activity patterns. Then, when a threat is identified, it can be immediately isolated at the endpoint to stop a ransomware outbreak.

Integrity Monitoring Tools

Integrity monitoring tools provide the ability to test, understand, and measure attacks that occur on files and components within the enterprise. The value of integrity monitoring becomes clear both during and after an attack. Alerts can be set to notify the security team to act when abnormal changes are detected to a file or system.

Firewalls

It is crucial to use next-generation firewalls that block unauthorized access to the computer or network. Additionally, firewalls should be augmented with web filtering specifically focused on sites that may introduce malware. SSL decryption capabilities must also be included. When the user/personnel runs the malware and virus checker frequently with updated virus and malware definitions, the security software can detect the ransomware and alert the user/personnel to its presence. Once detected, the ransomware can be quarantined and deleted, or once the ransomware is detected, administrators can opt to quarantine and delete it.

To explore these concepts in more depth, check out the publication Ransomware in the Healthcare Cloud by CSA’s Health Information Management Working Group. Written specifically with healthcare delivery organizations in mind, this publication covers information that is also applicable to anyone interested in ransomware. Learn more about:

• The particular challenge that ransomware poses to healthcare organizations
• The definition of ransomware
• The seven stages of a ransomware attack
• Ransomware attack vectors
• Identifying your organization's ransomware risk
• Protecting against ransomware
• Detecting ransomware
• Responding to a ransomware attack
• Recovering from a ransomware attack