By Steve Baer, Director of Cybersecurity and Networking, Paragon Micro
There’s a phrase I use when I talk about cybersecurity and ransomware preparedness with clients: you’re never done.
You can deploy a new security platform. You can strengthen your endpoint protection. You can segment your network, improve your backups and tighten your email security. Those are all important steps.
But none of them gives you the ability to declare your organization “secure” and move on.
The threat landscape doesn’t work that way.
Attackers keep changing their methods. Your technology environment keeps changing. Employees come and go. New applications are introduced. Vulnerabilities emerge. And every change can alter your risk.
That means cybersecurity resilience can’t be treated as a project with a finish line. It has to become an ongoing business discipline.
I was reminded of that recently while helping an organization through the aftermath of a ransomware attack. By the time we became involved, more than half of its workstations and laptops were down, its network-attached storage was unusable, and normal communications had been disrupted badly enough that employees were relying on personal cell phones and Gmail.
At that point, cybersecurity was no longer an IT conversation. It was a business-survival conversation.
TLDR
- Cybersecurity is a continuous business discipline. Threats, technology and business environments keep changing, so security can’t be treated as a one-time project. Put simply, cyber risk is business risk- full stop.
- Ransom preparedness requires more than prevention. Organizations need to be able to detect threats, contain an attack and recover when something gets through.
- Small IT teams need the right support. Cybersecurity has become too specialized for lean teams to maintain deep expertise across every area while also managing day-to-day IT.
- Backups are only as valuable as your ability to recover. The bad guys know it, and go after them. The real question is how quickly you can restore critical systems and resume operations.
- Layered security creates resilience. Multiple controls working together can help limit attack paths, reduce lateral movement and lessen the impact when one defense fails. There are no silver bullets.
- The right security strategy starts with the problem. Technology should be selected because it addresses a real business risk, not simply because another security product can be added.
Your Worst Day Is the Wrong Time to Build Your Cybersecurity Strategy
Effective cyber preparedness starts before there is an incident. It means having the right controls, processes, recovery plans and expertise in place before the pressure is on.
Because when an organization is in the middle of an attack, there are suddenly dozens of decisions that have to be made, and very little time to make them.
What happened? What systems can we trust? What should we isolate? What can we restore? How quickly can we restore it? Do we have clean backups? How do employees communicate if normal systems are unavailable? What are our legal obligations? What does cyber insurance cover?
And, inevitably: What do we need to buy right now?
That last question can be dangerous.
After an incident, there is a natural tendency to want to fix everything immediately. I understand it. When your organization has just been through something traumatic, nobody wants to leave the door open for it to happen again.
But fear isn’t a cybersecurity strategy.
Just because you brought a car, it doesn’t mean you know how to drive. The objective shouldn’t be to buy every security product you can find. It should be to understand the risk, prioritize what matters and put the right technologies and services in the right places where they are actually going to make an impact.
In the ransom situation I mentioned, there were immediate tactical priorities: gaining greater control over network access, segmenting the environment to reduce the attack surface, strengthening endpoint monitoring and establishing processes for responding when suspicious activities occur.
Those were important steps. But they were only the beginning.
Small IT Teams Can’t Be Expected to Be Experts at Everything
One of the realities I see frequently is IT teams are being asked to cover an enormous amount of ground.
In most organizations, a small team is responsible for both IT and cybersecurity.
They are all good people doing their jobs. The problem isn’t effort.
The problem is breadth.
Cybersecurity has become too specialized and too fast-moving to expect a handful of people to be experts across networking, endpoints, identity, email, vulnerability management, incident response, threat intelligence, backup and recovery, and still handle the organization’s day-to-day IT responsibilities.
As I said while we were discussing this incident, teams like these can end up becoming jacks of all trades, masters of none. That isn’t an indictment of the team. It is what happens when a small group of people is asked to cover an increasingly complicated environment. The dependency on those small teams represents it’s own flavor of risk.
Organizations need to be realistic about that.
Sometimes the smartest cybersecurity investment isn’t another product. Sometimes it is recognizing where your internal team needs additional expertise, monitoring or operational support.
The question should be: Where do we have the depth internally, and where do we need help?
Backups Aren’t About Whether You Can Recover, They’re About How Fast
Ransom recovery depends not only on whether backups exist, but on how quickly the business can restore critical systems and data. And a real-world worst case scenario is a disk wiper attack where your data is completely deleted.
That sounds obvious until you are the organization waiting for those systems to come back.
This incident reinforced something I think companies tend to underestimate until they desperately need it: having a backup and having a recovery strategy are not the same thing. Said differently, do you have good data to restore, and where are you restoring it too?
This organization was fortunate. It had usable tape backups.
Those backups mattered enormously. But restoring from tape was painfully slow. More than a month after the incident, the organization still wasn’t completely back on its feet.
While paying a ransom is a strategy companies often follow, there is no guarantee you will get a decrypt key. Oftentimes decryption exercises can corrupt up to 60 % of your data.
That should change the way leaders think about backups. The question isn’t simply: Do we have our data somewhere? The better question is: If our critical systems disappeared tomorrow morning, how quickly could we actually restore them? And then: Have we tested that assumption?
A backup that technically exists but takes an unacceptable amount of time to restore may protect the data without adequately protecting the business.
Recovery time becomes a business metric when operations are stopped.
That is why business continuity and cybersecurity must be part of the same conversation.
How confident are you in your ability to recover from a cyber incident?
Paragon Micro can help you evaluate your current security and recovery strategy and identify where additional controls, expertise or support may be needed.
Talk to a Cybersecurity Expert
Build Cybersecurity Layers, Not a Silver Bullet
A layered cybersecurity strategy uses multiple complementary controls so that one failed defense does not leave the entire organization exposed.
There is no single product that will solve cybersecurity.
A resilient security program relies on layers: network segmentation, endpoint security, email security, identity controls, web filtering, application controls, monitoring, backup and recovery, incident-response procedures and the people capable of acting on the information those systems provide.
Which layers an organization needs, and how sophisticated each one needs to be, depends on the business.
The goal is to create layers that work together to reduce risk, contain an incident when something gets through and give the organization a viable path to recovery, not just assemble the longest list of security tools.
In the incident I mentioned, network segmentation was one of the first tactical priorities. Separating computers from devices such as phones and printers helped create clearer boundaries and reduce the attack surface.
That is an important distinction because prevention cannot be the only measure of a security program’s success. You have to assume something may eventually get through. Then ask what happens next.
Can you see it? Can you isolate it? Can you stop it from moving laterally? Can you protect critical data? Can you continue operating? Can you recover?
Those questions tell me far more about an organization’s resilience than the number of security products it owns.
Cyber Insurance Is Only Part of the Plan
Cyber insurance can help manage some of the financial risk associated with an incident, but it does not replace a cybersecurity program. It’s important to understand what they cover before an incident occurs. Additionally, post incident reasonability often falls to the organization, leaving them paying fines, restitutions, damages, and lawsuits. Technology gear replacement is often amortized over deprecation cutting the costs for new gear.
An insurance policy cannot segment your network, stop a malicious email, patch a vulnerability, restore a server, and it can’t make decisions for your leadership team during an incident.
Organizations still have responsibilities of their own.
Partnering with your cyber insurer means understanding policy requirements, understanding which security controls you have represented as being in place and making sure those controls actually exist and are operating as expected.
Cybersecurity insurance often deploys digital forensics and incident response teams. Their goal is to determine what happened, and often to assess blame. Those incident responders work for the insurance company, not your organization. This may impact coverage.
After a significant incident, organizations should also expect their insurance situation to change. There may be more scrutiny, new requirements or higher premiums.
The right time to understand those requirements is before you need to make a claim, not while you are dealing with an active event.
Cyber insurance should complement risk management. It should never become a substitute for it.
Good Cybersecurity Advice Sometimes Means Saying “Don’t Buy That”
There is another part of cybersecurity that doesn’t get discussed enough: trust and candor.
During an incident, organizations can be flooded with options. Vendors have products. Insurers have recommendations. Internal stakeholders have opinions. Everyone wants the problem solved quickly.
That is when someone needs to be willing to say: No. Don’t do that.
I have always believed candor solves problems.
My job is not to recommend technology simply because we can sell it. It is to understand the problem and determine which technology or service will actually make an impact.
Sometimes that means recommending a solution. Sometimes it means telling a client that a proposed technology is not appropriate for what they are trying to accomplish. That may not always be the easiest conversation, but it is the right one.
In this incident, we were trying to solve the problem at more than one level. There were tactical security needs, longer-term strategic needs and economic realities to consider at the same time. The client was understandably emotional after what had happened, and some of the technologies they wanted to replace immediately still had financial implications attached to them.
That is why strategy has to come before products.
Sometimes the right answer is sophisticated technology. Sometimes it is a service that gives a small team capabilities it cannot realistically maintain on its own. And sometimes the answer is remarkably simple.
In this case, one recommendation was to maintain portable copies of critical data, keep them disconnected from the environment and rotate them offsite. It wasn’t something we were trying to sell. It was simply another way to create an out-of-band recovery option.
That is what a security advisor should be doing. Solve the client’s problem, not look for a product to attach to it.
The Real Goal Is Resilience
Cyber resilience is the ability to continue operating, contain the impact of an incident and recover when a cyberattack succeeds despite preventive controls.
No organization can eliminate cyber risk entirely.
That may be uncomfortable to hear, but accepting it leads to better security decisions.
The goal is to make it harder for attackers to get in. Harder for them to move through your environment. Easier for your team to recognize that something is wrong. Faster to contain the damage. And faster for the business to recover when something does happen.
That requires more than technology.
It requires the right controls, processes, expertise, tested recovery plans, leadership involvement, and an ongoing willingness to reassess where the organization is vulnerable.
Because the attackers are not standing still. Neither can you.
You don’t have to wait for an incident to strengthen your defenses.
Paragon Micro can help you evaluate your cybersecurity priorities and determine which technologies, services and next steps can make the greatest impact for your organization.
Frequently Asked Questions About Ransom Preparedness
How should a business prepare for a ransomware attack?
Ransom preparedness should address prevention, detection, containment and recovery. Organizations should identify critical systems and data, implement layered security controls, maintain and test backups, establish incident-response processes and make sure they have access to the expertise needed to respond when something goes wrong.
What is a layered cybersecurity strategy?
A layered cybersecurity strategy uses multiple security controls that work together rather than relying on one technology to stop every attack. Those layers can include endpoint protection, identity controls, network segmentation, email security, threat monitoring, vulnerability management, backup and recovery, and incident response.
Are backups enough to recover from ransom attacks?
No. Backups are critical, but organizations also need to know whether they can restore critical systems and data within a timeframe the business can tolerate. Recovery procedures should be tested before an incident so the organization understands what recovery will actually look like.
Is cyber insurance enough protection against ransomware?
No. Cyber insurance can help manage some of the financial impact of an incident, but it does not replace security controls, incident-response planning, backup and recovery, or ongoing risk management.