How are you defending yourself against ransomware?
Sort by:
I have a tool for app security that essentially gives me trends on how I'm doing on product security. My Security Information Management (SIM) is my single pane of glass on the operations side. I do integrate with my Endpoint Detection and Response (EMDR) solution and cloud ecosystem to give me more than just alerts. I am a numbers guy. Numbers speak to me better than colors, so I look at trends. If I am seeing a trend around a certain event or type of event, that is my target. If we are seeing similar event types like phishing, then that is my point of attack for the next quarter, and it establishes my immediate short-term goals.
I have a similar approach for Data Loss Prevention (DLP). DLP, is a beast by itself, so I don't have a single pane of glass for it. The tool itself is the metric there. When I joined this organization, I did not do an entire inventory assessment, I did a risk assessment of it. I took an inventory of what my attack surface is like: What is the risk and what is the potential of those risks being realized as threats? I mapped it into an OWASP or MITRE ATT&CK framework, and came up with a strategy to let the risk drive my implementations and initiatives, as opposed to just classifying assets and other initiatives.
That's what you have to do. KPIs and risk assessments are valuable—especially with boards and CEOs—to be able to get the funding you need.
Exactly. Your data is speaking, so there is no reason for senior management to turn down some of this logic. Second thing, you readily have these metrics to share with the board on, whenever, on a quarterly or biannual basis, so that it's already there.
One of the things I've been working a lot with my clients is to plan for failure. Assume that you will be violated. What happens then? What sort of policies, what kind of steps should you have in place, what kind of technologies do you have? Design for failure. Design for fragility so that you can create a more robust environment.
Fortunately, none of our customers have had ransomware incidents, but they are all very concerned about it. They’re looking at ways in which they can better manage their situation, including education. Technology's one solution, but they feel like the first thing they need to do is to educate their people to ensure that they understand the simple things. So it becomes a cohesive effort. Our organization is worried about ransomware and the first thing we're doing is educating everyone to take the right steps, like not opening emails of a suspicious nature, but also to plan for failure.
Off-site storage of backups every 12 hours on critical systems
And off-site storage of my resume