How businesses can protect Office 365 from ransomware attacks [Link - MTI Bytes]

After a recent webinar from Chris Taylor, Director of Product Marketing from Trend Micro around Ransomware, I created a blog post around this: https://www.mti.com/mtibytes/how-businesses-can-protect-office-365-ransomware-attacks/

=============================

In the last year, businesses have seen a large increase in ransomware threats. The Guardian recently reported that 54 per cent of businesses have been threatened with ransomware in the last 12 months alone. When we consider the money that can be made from a career in cyber crime, this is hardly surprising.

Ransomware refers to malicious software (malware) which is designed to block access to a computer system until a sum of money is paid.

But how can you protect your cloud environments from it? In a recent webinar, Chris Taylor, Director of Product Marketing, Trend Micro, looked at exactly that:

How does malware work?

Email is a common method that attackers will use to infect their victims, most often businesses. The malware is embedded in an email either in the form of a web link in the body of the text, which vulnerable users click on or a link within the attachment.

It is becoming increasingly more common for malware to be laced within documents in email attachments. Embedded JavaScript within the text encourages users to unknowingly click, starting the download of malicious software. It can be more difficult to detect the malware via the email attachment as it could be compressed within a common office file, such as a CV from a job-hunter, or an invoice, which seem convincing.

Prevention is better than cure

There are a number of recommendations that can be made, such as always back up your system, make sure it’s fully patched and train users not to open suspicious attachments. However, there are opportunities to stop many ransomware attacks before it even gets to that point. The best way is to block ransomware before it has a chance to reach users. There are certainly fix measures that can come in and save the day should the worst happen, but this can take up a lot of the IT team’s time.

What can businesses do to protect their Office 365 environment?

Office 365 includes anti-spam and anti-malware protection, which block every known malware. But the majority of malware is unknown, as criminals are increasingly using automated tools to change their malware, to beat the system.

In order to remain one step ahead from threats, businesses can implement advanced threat protection, which looks for malware in different ways, malicious URLs in attachments as well as the body of emails, and full data loss protection.

To set up a free evaluation of your Office 365 protection, email ukmarketing@mti.com

CLOUDSEC takeaway – Cyber security is not just an IT issue [Link - Trend Micro Blog]

After attending CLOUDSEC 2016, I was asked to create a guest blog on the Trend Micro blog site, including standout statistics and take-away lessons: http://blog.trendmicro.co.uk/cloudsec-takeaway-cyber-security-is-not-just-an-it-issue/

===========================

With a fantastic turnout at CLOUDSEC 2016, attendees comprised of security and IT practitioners from numerous industries. Despite these varying sectors, one thing became abundantly clear: the same issues are keeping IT security professionals awake at night – securing cloud environments, securing privileged access accounts and user education.

Many enlightening statistics were shared. Trend Micro’s research found that in the last two years, 44% of UK businesses were hit by ransomware attacks, and a third (33%) of their employees were affected by the infection. We also heard that over $2.3 billion was lost to phishing attacks over the past three years (FBI), though the real figure is likely to be higher.

While this makes the somewhat abstract world of cyber threats very real indeed, if there’s one point to take away from CLOUDSEC, it’s that cyber security isn’t just an IT issue. When the entire workforce is educated around safe IT usage, the chance of a business network being hacked is significantly reduced.

Everyone needs best practice training 

Organisations can defend against cyber-attacks; they don’t have to be victims. While in any organisation the CIO ultimately takes responsibility for cyber security, the rest of the organisation needs to accept responsibility too and not just shrug their collective shoulders. Regardless of seniority, companies should invest in best practice training when using a corporate network.

Best practice knowledge should percolate through the entire organisation from board directors, to employees and IT people involved in daily operations. It should explain why businesses have approved channels for storing data, the risks of using personal cloud storage platforms for data storage, and the need to question email content if it arouses suspicion – even if it’s from the CEO’s office.

Employees must understand the importance of cyber defences within the context of the business and how to safeguard against internal and external intrusions. Are they aware of the importance of setting difficult to crack passwords, as well as understanding that password variations of existing passwords are a source of vulnerability when used in other parts of the network? Do they know that in the last six months or so, ransomware attacks have spiralled as ransomware-as-a-service kits became commonplace on the dark web?

Serious business implications

The whole organisation must realise the possible business implications of a major hack – spiralling revenues, lost customers and plummeting share price, and this could all happen well after the event. Furthermore, jobs could be on the line if declining income hits the business badly.

Despite the growing evidence suggesting otherwise, many organisations still believe they won’t be hacked. With that said, however, if cyber security education is a part of the organisational culture, the chances of a serious breach are dramatically reduced.

Twelve Years....

Twelve years in technology

12 years doesn't seem like a long time ago, but in technology terms it's a very long time.

The Nokia 6310 was released in 2001 and its successor the Nokia 6310i was release 12 years ago.  iTunes is 12 years old, although the iPod has been around a little longer.  The iPhone has been with us for eight years and the iPad for five years.  So it doesn't just sound like an Apple-fest, the Blackberrys were in their hard case holsters and Android formed as a company in 2003.

Why is this relevant?  It’s not really, it’s just to put into perspective where technology was 12 years, the same time that Windows 2003 was released.

Windows 2003

Windows 2003 was released 24th April 2003, but as of 14th July 2015, Windows 2003 will no longer receive support from Microsoft.  There is also an IDC whitepaper covering why it’s important to upgrade here

What does no support mean?

When Windows 2003 no longer receives support there will be a number of impacts:

• No patches, updates and fixes - This means that whether a vulnerability or issue is security related or not, Microsoft are not obliged to patch it or fix it in any fashion.
• There will be no support from Microsoft - Fairly simple you'd think, but again any issues encountered can not be raised or escalated to Microsoft.
• Applications support challenges - As Microsoft no longer support the operating system, why would the application manufacturers.  This means that new versions of the application will only be supported on the newer operating systems.
• Compliance issues - There could be issues meeting compliance in healthcare or with PCI:DSS if an unsupported operating system is in scope.

Upgrade

The obvious answer is the upgrade, but if bespoke applications are being run and depend on specific versions of operating system or supporting applications such as databases running on specific version, upgrading is certainly not straightforward.

Protect

If you can't upgrade, or are unable to upgrade before the 14th July 2015, there is another option.  Trend Micro have solution called Deep Security, which can protect physical, virtual and cloud based servers.  Trend Micro Deep Security offers a number of features including anti-malware, intrusion prevention, host firewall, integrity monitoring, log inspection, application scanning and interestingly virtual patching.

Virtual Patching

Virtual patching or vulnerability shielding, is taking Trend Micro's understanding of the vulnerabilities and create a secure bubble around the Windows 2003 server preventing those vulnerabilities from being able to be used against the server.

Trend Micro Deep Security

Before being forced into a quick migration of your existing Windows 2003 servers, it would worth considering if Trend Micro Deep Security could be the way of keeping your existing environment secure for longer.