{"id":7208,"date":"2021-02-16T12:13:08","date_gmt":"2021-02-16T12:13:08","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7208"},"modified":"2021-02-16T12:13:09","modified_gmt":"2021-02-16T12:13:09","slug":"attack-isnt-over-until-post-event-analysis-says-so","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/attack-isnt-over-until-post-event-analysis-says-so\/","title":{"rendered":"A Cyber Attack Isn\u2019t Over Until the Post Event Analysis Says So"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7208\" class=\"elementor elementor-7208\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">To borrow a phrase from Oscar Wilde, to fall victim to a ransomware attack once may be regarded as a misfortune. To fall victim to a ransomware attack twice looks like carelessness.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">And yet, that is exactly what happened to an organisation just this month. They paid the ransom, received the decryption key, restored systems, and returned to \u2018normal\u2019, without carrying out post event analysis, and thinking the story was over and done with.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Until they were attacked by the same cyber criminals <\/span><a href=\"https:\/\/www.zdnet.com\/google-amp\/article\/ransomware-this-is-the-first-thing-you-should-think-about-if-you-fall-victim-to-an-attack\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">a second time<\/span><\/a><span style=\"font-weight: 400;\">, just two weeks later.&nbsp;<\/span><span style=\"word-spacing: normal;\">They neglected to carry out a full post event analysis exercise to find out how the attack happened in the first place, and by doing that, let the attackers back in.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The lesson of this story is that without <\/span><a href=\"https:\/\/www.ncsc.gov.uk\/blog-post\/rise-of-ransomware\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">post event analysis<\/span><\/a><span style=\"font-weight: 400;\"> which identifies compromised or vulnerable components of the network, and steps to remove or mitigate them, cyber criminals could take advantage, and successfully attack them again.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Why it\u2019s important to understand the causes of a cyber attack<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Cyber criminals are opportunistic attackers. Most victims are chosen simply because it is easy for them to make a profit from attacking them. Now that the attackers know that an organisation\u2019s network is vulnerable to attack, they may try again.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In addition, most cyber attacks are not one and done. In some cases, the attackers may have been lurking inside a network for some time before they are detected. According to research, the <\/span><a href=\"https:\/\/www.darkreading.com\/risk\/attacker-dwell-time-ransomwares-most-important-metric\/a\/d-id\/1338978\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">dwell time<\/span><\/a><span style=\"font-weight: 400;\">, or time between the attackers first infiltrating a network, and the attack being identified, varies between 43 days and 56 days on average. Some ransomware attackers piggyback off other forms of software which lurk undetected in systems until ready to strike (see the example of the now defunct <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/emotet-malware-is-a-gift-that-keeps-on-giving\/\"><span style=\"font-weight: 400;\">Emotet<\/span><\/a><span style=\"font-weight: 400;\">).&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">They will not withdraw from a network just because the attack is over, they will wait for the next opportunity. Therefore it is up to the victim to analyse the causes of the attack, and investigate the tactics, techniques and procedures (TTPs) that allowed the attacker to insert malware into the network, and compromise the organisation.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Once this post event analysis is done, the organisation needs to ensure that they have put the necessary control in place to both reduce the likelihood of another attack, and also to reduce the impact of an incident if it does happen again.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Post event analysis is a crucial step to recovery<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">For most organisations, a cyber attack is just the tip of the iceberg. Once the attack is over, they begin the long, arduous journey of rebuilding. Incident response and recovery requires the organisation to assess the damage, understand how their <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">network security controls<\/span><\/a><span style=\"font-weight: 400;\"> were compromised, rebuild systems, recover data, and more. This post event analysis can take weeks, disrupting operations and causing concern to customers.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">However while understandably, efforts are focussed on returning to operations, incident recovery must also work quickly to identify the cause of the attack to avoid the attackers coming back in before the organisation has had the opportunity to close the vulnerability.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Avoid becoming a victim once, let alone twice<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Cyber criminals are opportunistic &#8211; they attack organisations that they feel have weak defences. Avoid falling victim to a ransomware attack by ensuring that the organisation\u2019s <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">network security posture<\/span><\/a><span style=\"font-weight: 400;\"> is mature enough to keep cyber criminals out.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Just some of the elements of securing an organisation\u2019s network security include:<\/span><\/p>\n<ul>\n<li><span style=\"font-weight: 400;\">Monitor the network perimeter at all times, and ensure alerting systems are in place to pick up and notify of attacks<\/span><\/li>\n<li><span style=\"font-weight: 400;\">Segment networks to ensure that an attacker can\u2019t compromise the entire network in the event of a breach<\/span><\/li>\n<li><span style=\"font-weight: 400;\">Prevent malware being delivered through emails by setting filters that only allow permitted file types, and alert when suspicious files are received<\/span><\/li>\n<li><span style=\"font-weight: 400;\">Make sure security patches are <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/vulnerability-chaining-gives-access-us-gov-networks\/\"><span style=\"font-weight: 400;\">up to date<\/span><\/a><\/li>\n<li><span style=\"font-weight: 400;\">Change default passwords across all access points<\/span><\/li>\n<li><a href=\"https:\/\/outofsite.biz\/cynance\/secure-passwords-dont-protect-network-security\/\"><span style=\"font-weight: 400;\">Apply multi factor authentication<\/span><\/a><span style=\"font-weight: 400;\"> to all systems where applicable<\/span><\/li>\n<li><span style=\"font-weight: 400;\">Support employees to set strong passwords and recognise the signs of a social engineering attack (for example a phishing or <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/smishing-text-messages-are-cyber-attacks-on-phones\/\"><span style=\"font-weight: 400;\">smishing<\/span><\/a><span style=\"font-weight: 400;\"> attack)<\/span><\/li>\n<li><span style=\"font-weight: 400;\">Require the use of a VPN to access the organisation\u2019s network from a remote location<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">And if these defences fail, ensure that there are solid incident response and recovery plans in place.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Incident response &#8211; ensuring all is not lost<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Sadly, not all ransomware attacks can be prevented, and that\u2019s why it is recommended to have a comprehensive, fully documented and tested <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/\"><span style=\"font-weight: 400;\">incident recovery plan<\/span><\/a><span style=\"font-weight: 400;\"> in place.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">A complete, tested plan which includes requirements such as creating regular system backups will ensure that in the event of a ransomware attack the organisation is able to restore systems successfully, potentially avoiding the need to pay the ransom &#8211; avoiding a reputation hit, and the double costs of the ransom and post event analysis.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Further damage can also be avoided by including the tasks, roles, and responsibilities for team members to carry out, and in which order. For example, assign team members to inform the public or authorities, identify IT team members who need to work quickly to carry out the post event analysis and recovery functions, and even identify any expert support needed to achieve this.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">And that circles back to the starting point. It\u2019s not over until the post event analysis says so.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>To borrow a phrase from Oscar Wilde, to fall victim to a ransomware attack once may be regarded as a misfortune. To fall victim to a ransomware attack twice looks like carelessness. And yet, that is exactly what happened to an organisation just this month. They paid the ransom, received the decryption key, restored systems,&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7211,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7208"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7208"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7208\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7211"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}