Translated from 日本語 • View original 
Background: The Rise and Sophistication of Ransomware
According to recent statistics, ransomware attacks are increasing at a rate of 20-30% every year, and the scale of damage is increasing year by year. Attackers are highly divided into criminal organizations rather than individuals, and they "commercialize" the provision of tools, ransom negotiations, and encryption services. This is the rise of the so-called "RaaS (Ransomware as a Service)".
Of particular note is the increase in "double extortion". This is not just a method of encrypting data and demanding money, but also threatening to publish stolen information, increasing pressure on companies that refuse to pay. Against this background, we are entering an era where backups alone cannot be defended.
Attack vectors are also diverse, and infections can occur through any route, including email attachments, intrusions via VPN and RDP, tampering with software update paths, or exploiting cloud misconfigurations.
In particular, companies with more remote work environments and outsourcing have a wider scope of control and higher risk of intrusion.
Attack Techniques and Risks
Typical ransomware attacks include:
- Email attachment: Attach malware to phishing emails to exploit users' carelessness
- Vulnerability exploitation: Targeting unpatched OS and apps
- Via RDP and VPN: Exploiting poor remote access settings or weak authentication
- Double extortion type: Double demand for money with encryption + threat of information leakage
These not only result in operational outages and increased system recovery costs, but also face discredited and legal risks due to information breaches. In recent years, attackers have increasingly disrupted the recovery process, which can take weeks or months to recover.
Countermeasures: Building Defense-in-Depth
Effective ransomware countermeasures are not a single tool, but a multi-layered defense posture across the organization.
- Environmental Preparation
First, thoroughly manage vulnerabilities in your OS and apps. Along with automating updates, remove unnecessary services and accounts and enforce the principle of least privilege. It's also important not to use admin privileges for day-to-day operations. - Establishment of a monitoring system
Implement EDR (Endpoint Detection and Response) and SIEM (Security Information and Event Management) to detect behavior-based anomalies. The key is how quickly you can find the "signs" from initial intrusion to encryption. - test operation
It uses a sandbox environment to analyze suspicious files and perform attack simulations. SOC teams can train response procedures to respond quickly during actual incidents. - production operation
Backups enforce the "3-2-1 rule" (three copies, two types of media, and one offsite) and document recovery procedures. It also requires quarantine storage to ensure that backup data is not subject to encryption attacks. - Continuous Improvement
Regularly collect threat intelligence and update your defense rules to align with new attack techniques. Let's entrench this as a PDCA cycle for security operations.
What it should be
The ideal state is a system that can minimize damage even if it is invaded.
In other words, the process of detection, containment, and recovery is automated, reducing the time to recovery (RTO). In addition, the entire organization must have a design philosophy that assumes the occurrence of an incident. If you have an environment where you can test repeatedly and continuously improve from the attacker's perspective, you can significantly reduce the threat of ransomware.
Conclusion
Ransomware is an ever-evolving cyber threat.
But the basic principles remain the same. Defense-in-depth + continuous monitoring + establishing backups is the most realistic way to minimize damage.
Even with limited resources, visibility, prioritization, and defense of risk are the first steps to a resilient security posture.