Libby Bevin

Understand the policies and practices that differentiate traditional network security from cloud security, and how to keep your data safe.

For organizations collecting more data every year, traditional IT systems and servers no longer provide cost-effective scalability. So most organizations are investigating, or already using, a cloud environment for data storage.

Whether your organization uses cloud storage or a traditional IT system, understanding the differences between cloud security and traditional security will help you stay secure and compliant.

Cloud Security vs. Traditional IT Systems

While some organizations manage and store their data in on-premises data centers, their numbers are dwindling. More and more are migrating to the cloud to maximize scalability and cost-saving opportunities.

Cloud technologies make data management much easier. Companies can access infrastructure on demand, which enables them to maintain efficient and effective cloud security frameworks that keep up with emergent threats. The result: better data security.

Distinguishing between traditional IT security and cloud security is crucial, and it’s important to identify and understand the pros and cons of each. Taking a closer look at both approaches will allow you to make the best decision for your organization.

What Does ‘Traditional IT’ Mean?

Traditional IT involves purchasing, installing, and maintaining your IT devices on-site.

When you create a typical IT infrastructure, you connect your on-premises hardware devices to servers to store information. The traditional IT setup not only provides greater control over your data environment; it also gives you a strong cybersecurity stance.

Traditional IT infrastructure allows you to implement a plan for data security. It also gives you the freedom to determine which security devices you’ll purchase, how you’ll manage network controls, and how to best respond to incoming threats. With the traditional IT framework, you’ll also be responsible for maintaining a disaster recovery plan, as well as detecting and responding to incoming threats.

A traditional IT approach gives you more control over how each device is used. Being able to see where and how your data is controlled, as well as being involved in its daily management, may feel like a “win” for your organization.

The cost of installation and the amount of maintenance required are the biggest downsides to traditional IT systems. And as you collect more data, you’ll need to purchase more machines that can process larger amounts. You’ll also likely need more in-house personnel to manage hardware day-to-day.

Although your on-premises data center may provide you with a lot of control over your data processes, the costs of using traditional IT can be high. Smaller businesses, especially, may have a hard time affording it.

Network security and traditional IT

Network security, a subset of information security (or “infosec”), consists of an organization’s policies and practices intended to prevent, identify, and monitor unauthorized access or abuse of a computing network.

Traditionally, network security falls under the umbrella of traditional IT infrastructure. Protecting your network using tools to protect data, applications and resources at the network level is part of on-premises operations.

While network security focuses solely on protecting your networks, securing traditional IT environments typically involves using firewalls and monitoring tools to lock down private networks.

What Is a Cloud Services Provider?

A cloud services provider allows you to incorporate the internet as a storage location and enables cost-effective scaling. On the other hand, you’re also reliant on the service provider’s cloud security controls.

Cloud computing comes in three different formats: public, private, and hybrid.

Public cloud

Many people are familiar with public cloud service providers. Google Cloud platform, Amazon Web Services (AWS), and Microsoft Azure all offer Infrastructure-as-a-service (IaaS) to enable scalability. Due to the massive amounts of information they store, however, public cloud environments find themselves targeted by malicious actors and can be subject to malware.

According to the McAfee 2018 report Navigating a Cloud Sky: Practical Guidance and the State of Cloud Security, 25 percent of companies using public cloud IaaS or Software-as-a-Service (Saas) have experienced data theft.

Private cloud

If you’re looking to mitigate the data security issues associated with public clouds, you might think that creating your own cloud will allow you to have more control. Although a private cloud enables you to maintain control over your data centers and cybersecurity compliance concerns, the costs rapidly outpace many companies’ financial capabilities.

A SearchCIO article notes that private cloud costs including running your data center and hiring the appropriate IT staff can be as much as $1.5 million.

Hybrid cloud

A hybrid cloud offers the best opportunity for many organizations seeking to scale.

As the name suggests, a hybrid cloud means you’re using both the public cloud as well as an on-premise private cloud. To save money, use your private cloud for only the most sensitive data and use a Platform-as-a-Service (PaaS) public cloud provider for other data.

For example, you might store all your payment information on your private cloud and then use your PaaS for software deployments or data that doesn’t incorporate personally identifiable information.

Network Security vs. Cloud Security

Network security includes tools that are used to protect data, applications, and resources at the network level, with a primary focus on protecting against unauthorized access into or between parts of the overall network infrastructure.

Both network security and cloud security demand highly advanced features, constant monitoring, and increasing storage space for maintaining a resilient security environment. They are, however, entirely different entities. Each offers various pros and cons for organizations.

The major differences between network security and cloud security are as follows:

Network Security	Cloud Security
Focuses solely on protecting your networks.	Provides an overall protection for networks, servers, containers, apps, and more.
Works on a data authorization system that needs access by a network administrator every time someone tries to access your company data. It secures the network as well as protects and oversees operations.	Protects your data from unauthorized use or access, distributed denial of service (DDoS) attacks, hackers, malware, and other risks on these platforms.
Combines multiple layer security check barriers at every stage of information management, where each stage has its own policies and controls of protection. The information stored can be accessed by authorized users only.	Works on encryption, identity access management (IAM) products, and web application firewalls that give overall protection to your data on all platforms.

Essentially, network security combines multiple layers of defense at the perimeter and center of the network. Each network security layer implements policies and controls allowing authorized users access to network resources and blocking malicious actors from carrying out exploits and threats.

Network security includes any activity designed to protect the usability and integrity of your network and data. It encompasses both hardware and software technologies, targets a variety of threats, stops threats from entering or spreading on your network, and manages access to your network.

Cloud security is the protection of data, applications, and infrastructure involved in cloud computing. Whether it’s a public, private, or hybrid cloud, many aspects of security for cloud environments are the same as for any on-premise IT architecture.

What Makes Cloud Security Different?

Cloud environments change the way we access and store data. Because the information doesn’t live on your servers, you need to use tools called application programming interfaces (APIs) that let your devices and servers communicate to the cloud servers.

Each API acts like a door that connects your systems to others. But since you don’t control the locks enabling who can go in and out, you also can’t secure it appropriately.

In other words, you’re not just working with your cloud service provider. You’re working with all the applications that connect your software, networks, services, and devices to your cloud.

Ultimately, cloud security is the preferable choice for organizations to keep their data safe. Unlike network security, cloud security provides greater cost, control, and safety benefits. To capitalize on enhanced security options, organizations must partner with the right cloud service providers to mitigate cloud security threats.

How To Mitigate Cloud Security Threats

With cloud infrastructures, you need to think more broadly about cybersecurity. While you may control the information shared with your cloud services providers, you don’t always control who can access it.

Continuously review data stored in the cloud

Although you don’t control everything within your cloud environment, you can maintain review over the information stored there.

With data continually being transmitted between your on-premises infrastructure and cloud infrastructure, you may not always know what is stored where. The constant data sharing eases workloads, but it can also lead to outdated information residing in your cloud.

You should regularly review the software and data sharing to your cloud to assure that only information you want there resides there. If you’ve deployed software from the cloud, make sure that you no longer store outdated versions there.

You also need to review your cloud server regularly to make sure no out-of-scope critical or protected data resides there.

Establish a vendor management program

Cloud service providers are vendors. You not only need to trust them; you need to verify their security controls to protect yourself from data breaches. You need to establish agreed-upon controls and service level agreements with cloud service providers and any vendors whose APIs you use.

Understand your cloud service provider’s controls

Whether it’s using a public cloud or hybrid cloud, your service provider is going to be storing and transmitting your data.

You need to assure that the cloud provider incorporates an appropriate level of protection over that data. Unfortunately, even though you’re contracting with the cloud service provider, you own the data at risk.

It’s important to understand how your service provider encrypts data and controls access and authentication. You also need to know its incident response plans.

Know your compliance requirements

If you need to comply with the EU General Data Protection Regulation (GDPR), you need to make sure your cloud service provider offers local data centers.

If you need to report data breaches under a regulatory requirement, you need to assure that your cloud services provider will keep you informed so that you can stay compliant.

Continuously monitor threats

In the same way that you monitor your data environment, you need to monitor the continuously evolving security risks to your cloud infrastructures, including cyberattacks.

The primary concern over engaging a hybrid cloud infrastructure is lack of visibility into who accesses all the points of entry. Unfortunately, while others maintain controls, you’re ultimately responsible for any data breaches arising out of your third-party vendors, including your cloud providers.

How ZenGRC Can Help

You can’t be everywhere at once, but you can maintain documentation of your due diligence.

ZenGRC from Reciprocity is a governance, risk, and compliance (GRC) SaaS platform that offers a variety of cloud security solutions by streamlining management for a variety of tasks that are necessary to mitigate security threats.

It also offers a “single source of truth” for all your documentation. ZenGRC’s system of record consolidates any assets, objectives, controls and history to a single list, making it easy to stay on top of your compliance and risk program.

ZenGRC can also help you manage vendor risks and improve vendor relationships with automated third-party risk management. Providing vendor questionnaires, business impact questionnaires, and vendor-specific reporting, ZenGRC removes the burden of third-party risk management put on internal teams.

Additionally, with workflow tagging and task prioritization functions, ZenGRC allows you to communicate with internal stakeholders involved in monitoring your cloud security.

Contact Reciprocity today and schedule a demo to discover the zen way with ZenGRC.

The Cybersecurity Maturity Model Certification (CMMC) program was created by the U.S. government to create a set of standards that all organizations must meet to be eligible to bid on or renew contracts with the U.S. Department of Defense (DoD). These standards establish a benchmark against which assessors can measure your organization’s security posture – and if you’re one of the hundreds of thousands of vendors that work with the DoD, you’ll need to have your CMMC in place by October 25, 2025 in order to continue that relationship.

While 2025 may seem a long way off, CMMC takes time so it’s important to start preparing sooner rather than later. Unfortunately, there is no standard timeframe for how long the process takes. It may take smaller companies less time than a larger or more sophisticated organization. Putting together the required documentation can take six to nine months alone, so acting now will be key to your success. 

Here’s how to get ready for your organization’s CMMC assessment:

1. Conduct a Self-Assessment: To help streamline the CMMC process, the DoD requests that you complete a self-assessment before scheduling your CMMC assessment. Conducting self-audits or self-assessments in advance will also help you cut down on CMMC certification costs. Using a CMMC Compliance tool can help kick-off this process, providing an easy and efficient way to organize, manage and streamline CMMC compliance requirements to help you achieve positive audit results.
2. Consult with a Professional: While the DoD has a website that vendors can use for guidance, contact information and to submit their assessments, consulting with a firm that provides CMMC assessment, or a certified third-party assessor (C3PAO) is also a good idea. The assessor or C3PAQ you contact can tell you precisely what your assessment will entail, and advise you on how to prepare. 
3. Prepare for the CMMC Audit: Only a CP3AO is qualified to perform a CMMC audit. The extent of your audit will depend on the maturity level for which your organization wishes to be certified. The assessor will first speak with you to determine your needs and will request any documents required to evaluate your controls for protecting FCI or CUI. They will also inquire about the systems you’re using and what services you are providing and supplying to the DoD. These documents may include diagrams of your environment, risk assessments, data from vulnerability scans and a list of in-scope controls. (FYI – collecting and organizing these documents prior to your audit can be a challenge if you’ve never done it before. Working with a Governance, Risk and Compliance (GRC) expert who is well-versed in the process will help keep things on track!)

Once you’ve completed these steps, you’ll be ready to submit your CMMC assessment. 

To learn more about how you can prepare for your CMMC audit, watch our on-demand webinar Shedding Light on the Path to CMMC Success.

Cyberattacks can devastate your company. No matter how strong your defenses may be, hackers and cyber thieves are working hard to outsmart your security systems and gain access to the confidential data of your customers and staff. 

So far in 2021 alone, organizations such as Facebook, T-Mobile, and even the California Department of Motor Vehicles have fallen victim to data breaches. If global corporations and government agencies are at risk for cybercrime, rest assured that your company needs to increase its focus on security, too. 

Traditional defenses like firewalls and antivirus software are insufficient in the face of today’s advanced security threats. Let’s look at some of these threats in detail, along with warning signs of a breach and best practices for a strong defense against them. 

Common Advanced Security Threats

Trojan Malware

Trojan malware is sometimes referred to as a virus, which is a bit of a misnomer. Viruses are able to spread on their own, whereas the execution of a Trojan requires the recipient to open or click on the seemingly innocuous link, allowing the malware to wreak havoc on his or her system. There are many different kinds of Trojan malware tailored to a variety of different end goals. They can create a backdoor into your system, steal email addresses, install ransomware, and more. 

Rootkits

Rootkits are similar to Trojans in execution, but are specifically designed to remain on your computer in secret. Once in place, rootkits operate in the background, allowing hackers to disable security measures, install key trackers, steal sensitive information, and control your computer remotely. 

Spear Phishing

Most people are familiar with phishing, but spear phishing is a more advanced and dangerous phishing technique you may not have heard about. Traditional phishing scams send malicious emails to a large number of people; spear phishing pursues a specific target. These criminals research the structure of your company on social media sites to pose as a specific member of your team, thus gaining the trust of the target and enabling them to request login credentials, credit card numbers, and even wire transfers. 

Malicious Email Attachments

For this tactic hackers send emails to their targets with malware disguised as PDFs, Excel tables, voice memos, or other ordinary business documents. The body of the email is crafted to entice the reader to open the attachment (“read this latest memo from the boss”), which will then unleash the malware on your system. 

Drive-By Downloads

These are code hidden in websites — sometimes perfectly benign websites — that cause a virus or malware to attach itself to your computer. This kind of attack can gain access to your system without any further action from its target, making it one of the more dangerous and unpredictable threats. 

Signs of an Advanced Cyber Attack

An IBM report from 2020 found that on average  it can take 228 days for a breach to be detected. The amount of damage that can be done in those 228 days is astronomical, and added recovery time means it could be a year or more until you are back to business as usual. 

Clearly if your network is breached, you may not notice right away. Cyber attackers are clever, and they know how to hide in plain sight to avoid detection. The best defense against these attacks is awareness and vigilance; here are some warning signs to watch out for: 

Slow Network Connection

A change in connection speed can often indicate that a breach has occurred and that malicious programs are working in the background without your knowledge. It could also be the result of a hacker controlling your computer remotely.

Unfamiliar Programs Running in Task Manager

If you have noticed unusually slow connection speeds, Task Manager is the first place to check. Mysterious programs running without your knowledge will overtax your CPU and cause your computer to overheat. An increase in activity is also a common symptom of a denial-of-service attack, where hackers flood your system with illegitimate requests to keep actual work from being done. 

Unusual Transactions

Have you noticed suspicious behavior on your accounts? Even seemingly innocuous payments or messages can indicate that someone has accessed your computer from the outside. Hackers often make small changes to see if you’re paying attention and then move on to larger attacks in the future. 

Unusual Password Behavior

Similarly, pay attention if passwords seem to have been changed without your knowledge or you are getting requests for password resets that you did not initiate. This could be a sign that your system has been infiltrated and that hackers are working towards gaining further access. 

Large Amounts of Data Ready for Export

Once hackers have gained access, they will gather and compress stolen data in order to export it more efficiently. If you find data grouped or in a format that is unfamiliar, then a breach has likely occurred. 

Targeted Phishing Emails 

Once hackers have access to internal documents, spear phishing campaigns become a lot easier. If you’ve seen an increased number of these kinds of emails you may have already been breached without your knowledge. 

Increased Outgoing Emails

Hackers frequently use computers that they have infiltrated to phish and access other computers in your network. People are more likely to open otherwise suspicious attachments if they are coming from a trusted source within the company. 

How to Protect Against Cyberattacks

Your computer systems will be constantly under threat from these cyber risks. To evade them, you’ll need to promote awareness throughout your organization and use the many security tools that are available to you. 

Employee Training

Early detection is the best defense against advanced persistent threats, and it’s imperative to make sure your staff is informed about the warning signs of security breaches. Inform your employees about the benefits of strong passwords and two-factor authentication. Regular company training on advanced cyber threats can teach your employees what to look for, as well as assure that they know who needs to be informed of any potential breaches. 

Update Your Systems Regularly

These updates are created with the explicit purpose of combating new cyberthreats as they arise. When you receive a notification for an update, don’t ignore it. Your operating system needs to be updated regularly to correct vulnerabilities and continue running smoothly. 

Use Technology to Your Advantage 

Just as hackers are constantly finding ways to subvert your defenses, security technology is constantly evolving to combat new threats. It may seem like a never-ending race to get ahead of potential breaches, but using new technology can be incredibly beneficial to your company. Encouraging your staff to use password vaults and installing malware detection can be great first steps that are fairly easy and inexpensive to execute. VPN firewalls are also more beneficial than their earlier counterparts as it includes encryption as part of its defense. Always make sure to prioritize the data that would be the most valuable to hackers, as this will be the first area targeted during an attack. 

Technology can also be a valuable asset to your overall risk management program. If you don’t know where to begin, ZenGRC can help. Our software allows your team to track cybersecurity risk across your entire company with ease, providing a streamlined, integrated experience. ZenGRC is compliant across a number of frameworks, which will allow you to use it regardless of your field. Schedule a demo today to learn more about how ZenGRC can help your company prepare for any threat that may come your way.

What is Risk Transfer?

Risk transfer is a risk management technique where risk is transferred from your organization to a third party. Transferring risk means that one party assumes the general liabilities of another party.

One example of risk transfer is purchasing insurance. A company purchases insurance to cover the costs for some unwanted event – say, a data breach – and therefore as a practical matter, the cost of that risk is transferred: from the business, to the insurance firm.

Other examples include indemnification clauses in contracts (or “hold harmless” clauses), contractual requirements to provide insurance coverage for another party’s benefit, and reinsurance.

Risk Transfer in Risk Management

Risk management is the process of minimizing the impact or preventing unfortunate events from occurring. By identifying, assessing, and controlling threats to your organization’s capital and earnings, you can better prepare for the unexpected by minimizing risks and extra costs before they happen.

In addition to identifying and analyzing possible risks, your organization should also determine the most suitable risk response by taking the following steps:

1. Risk assessment
2. Risk analysis
3. Risk evaluation/prioritization
4. Risk treatment/mitigation
5. Risk monitoring/review

Usually, risk transfer takes place during the risk treatment/mitigation phase of a risk management program.

On a chart commonly referred to as a “risk register,” your organization should list each risk and give it a materialization score and rank, as well as a risk response or treatment. Risk treatment/mitigation typically comes in four options:

• Risk acceptance
• Risk avoidance
• Risk transfer
• Risk reduction

In cases where transferring risk makes the most sense, the potential loss from an adverse outcome is shifted to a third party. Usually, a policyholder will provide compensation to an insurer in the form of periodic payments (that is, insurance premiums) for bearing the risk.

Risk Transfer vs. Risk Sharing

The ideas of risk transfer and risk sharing are often confused because the two are similar, but each concept is slightly different from the other.

While the transfer of risk involves transferring risk to another individual or entity for a price, risk sharing involves sharing or dividing a common risk among two or more persons.

Also known as risk distribution, risk sharing means that the premiums and losses of those sharing the risk are allocated using a predetermined formula.

Methods of Risk Transfer

Insurance Policy

Purchasing insurance is perhaps the most common method of transferring risk.

When a policyholder purchases insurance from an insurance agent, he or she shifts financial risks to the insurer. In exchange for accepting such risks and providing insurance coverage, insurance companies typically charge a fee – the insurance premium.

Indemnification Clauses in Contracts

Also used in the transfer of risk, contracts often include an indemnification clause: a clause assuring that any potential losses will be compensated by the other party.

Also known as a hold-harmless or a save-harmless clause, an indemnification clause is independent of insurance coverages.

Examples of Risk Transfer

Insurance

Insurance is probably the easiest to understand example of risk transfer. Insurance shifts the risk of incurring significant financial losses to an insurance company, and protects the business owner against financial risks.

In some cases, through subrogation, insurance companies reimburse the policyholder and then pursue legal action against the party at fault to cover any financial burden.

Although risk is most commonly transferred from individuals and entities to insurance companies, insurers are also able to transfer risk themselves. Reinsurance companies are firms that provide insurance contracts to insurance firms. And like insurance companies, reinsurance companies charge an insurance premium in exchange for taking the risk of loss.

Other Industries

Risk transfer is also common in industries like construction. Ultimately, risk transfer is the basis of every contract that a construction company signs. In exchange for services, construction companies agree to take on certain risks involved with the project.

Property owners also transfer risks quite often. For example, commercial property owners often face a variety of risks and challenges with their tenants. For this reason, property owners should always implement an indemnity clause or hold-harmless agreements that release the indemnitor from any consequences or general liabilities due to the actions of the indemnitee.

Why Transfer Risk?

Transferring risk removes liability from your organization and puts it elsewhere, either in the hands of an insurance company or back onto whoever signed your contract containing an indemnification clause.

Without insurance or a contract, injuries or property damage caused by a third-party might involve you in an unforeseen claim situation. When done effectively, risk transfer allocates risk equitability and places responsibility for any risk on the designated parties.

Otherwise, the most obvious reason for transferring risk is to protect your organization from potential financial liabilities.

Requiring service providers, lessees, vendors, and subcontractors to enter into indemnification clauses or hold-harmless agreements will help assure that they will hold you harmless and reimburse you for any monetary losses if you are held liable for their conduct.

Effective Risk Transfer Strategies

To establish an effective risk transfer strategy:

• Require certificates of insurance from subcontractors, tenants, service providers and other parties.
• Determine appropriate insurance coverage and limits.
• Develop a system that enables an annual review of certificates of insurance for multi-year relationships prior to the work starting.
• Enforce certificates of insurance requirements.
• Create a certificate of insurance filing system for annual review.

How ZenGRC Can Help

An effective and efficient risk management program is paramount for risk transfer. But without the right tool, risk management can be overwhelming.

Fortunately, ZenGRC from Reciprocity can help you better understand what you need for a successful risk program.

ZenGRC’s operational risk management software lets you address enterprise risk management (ERM) and cybersecurity risk across threats, vulnerabilities, and incidents from one application; and communicate current risk status and potential threats through risk heatmaps, dashboards, and reports.

With continuous risk monitoring, ZenGRC exposes compliance-related risks with intuitive and automated alerts and workflows so you can catch and remediate risks with real-time updates.

Schedule a demo today to learn how ZenGRC can fit into your business and help guide you to confidence in infosec risk and compliance.

Ransomware-as-a-Service (RaaS) models let cyber criminals extort the companies they target by stealing data with malicious code. Learn what you can do. 

What is Ransomware-as-a-Service (RaaS)?

Ransomware-as-a-Service (RaaS) is a subscription-based business model that allows ransomware affiliates — that is, cyber criminals — to use previously developed ransomware tools to execute ransomware attacks against others. Others such as you. 

Similar to Software-as-a-Service (SaaS), the RaaS model lets ransomware developers sell or lease their ransomware to other parties, who then use that software to attack organizations. For this service, the ransomware developer typically earns a percentage of the ransom payment received.

Ransomware is malware that encrypts and locks targeted files. Since decryption is practically impossible, ransomware allows cyber criminals to hold the files hostage and demand a ransom in exchange for decryption keys. 

The first known ransomware attack is believed to have occurred in 1989, and lately ransomware has become the modus operandi of cyber criminals across the globe. A report from the Beazley Group says ransomware attacks increased by 25 percent from Q4 2019 to Q1 2020, and all evidence suggests the attacks have proliferated even more since then.

Largely opportunistic, ransomware attacks usually infect myriad easy targets to collect the highest financial reward. A January 2020 Coveware report found that the average ransom payment jumped from $41,198 in Q3 2019 to $84,116  in Q4 2019 — an increase of 104 percent.

Ransomware-as-a-Service further expands the current ransomware threat landscape by letting criminals use already-developed ransomware products for their attacks. With RaaS, even the most inexperienced hackers can now launch highly sophisticated cyberattacks. 

RaaS solutions also typically pay their users high dividends. In some cases, attackers earn up to 80 percent of each ransom payment. 

Ransomware will likely remain a widespread and serious threat. It will almost certainly continue to grow and evolve as RaaS becomes more accessible to more cyber criminals. Therefore, it’s important to understand how ransomware works, and how you can protect your organization from a ransomware attack.

How RaaS Works

A relatively new business model for ransomware developers, RaaS allows developers to sell or lease their ransomware to others — often called affiliates —  who then use them to launch cyber attacks. 

RaaS begins with expertly coded ransomware developed by “reputable” ransomware operators. RaaS ransomware usually has a high chance of penetration success and a low chance of discovery.

After the ransomware is developed, it’s then modified to a multi-end infrastructure so it can be licensed to multiple affiliates.

To recruit affiliates, many ransomware developers post queries on dark web forums. Affiliates are provided with onboarding documentation, including a step-by-step guide for launching attacks using the ransomware. Some RaaS solutions also provide a dashboard to help affiliates monitor the status of each ransomware attack.

Like SaaS, the revenue model for RaaS operates using an affiliate program. Affiliates either sign up with a one-time fee or a monthly subscription. Some RaaS operators don’t even use sign-up fees; affiliates can sign up to work on a commission basis. 

After RaaS affiliates sign up to gain access to ransomware, the developer will create a custom exploit code licensed to that particular affiliate. Once affiliates have access to the custom exploit ransomware code and instructions, they’re ready to launch a cyber attack.

How Ransomware Attacks Happen

After a RaaS affiliate has the custom ransomware code in its possession, it can identify and target an infection vector and deliver the exploit code to the victim (via malicious email, for example). 

Most ransomware attacks are executed via phishing. Phishing is a method of stealing sensitive data (like passwords and payment information) by duping the victim with a bogus email message. Phishing emails are a quick and easy way for cyber criminals to gain access to their victims’ servers. 

If the victim clicks the link in a phishing email, the ransomware is downloaded and executed on the computer the victim used to access the website. 

The ransomware then encrypts the victim’s files, identifies additional targets on the network, modifies system configurations to establish persistence, disrupts or destroys data backups, and covers its tracks. 

After the data has been encrypted, the victim typically receives a ransom note with instructions to pay it with untraceable funds (usually cryptocurrency). Money launderers move the money through multiple transformations to hide the identities of the ransomware affiliate and the developer. 

Once funds are received by the affiliate, they may or may not send a decryption key to the victim. The affiliate may make additional demands, or do nothing at all and leave the victim stuck with encrypted files. 

When an internal host is infected, preventing the ransomware from spreading to other computers within the network can be difficult. 

The most effective way to prevent ransomware from spreading to other computers is to disconnect it from wired connections, Wi-Fi, and Bluetooth as soon as possible. Automated backups to local or external storage should also be disabled to prevent them from being destroyed. 

To lessen the likelihood of a successful web-based malware download, firewalls that implement whitelisting or robust blacklisting may deter ransomware from connecting to command-and-control servers. 

Firewalls should also limit or completely block remote desktop protocol (RDP) and other remote management services. 

Common ransomware threats 

As mentioned above, the most common method for ransomware attacks is phishing. Using phishing emails, cyber criminals can obtain sensitive data by tricking a victim into clicking a link that automatically downloads the ransomware. 

The 10 most active ransomware variants and their respective market share percentage in Q1 2020 are as follows:

1. Sodinokibi (26.7%)
2. Ryuk (19.6%)
3. Phobos (7.8%)
4. Dharma (7.8%)
5. Mamba (4.8%)
6. GlobeImposter (4.4%)
7. Snatch (2.6%)
8. IEncrypt (2.2%)
9. 777 (2.2%)
10. MedusaLocker (2.2%)

Of these 10 ransomware variants, Sodinokibi, Phobos, Dharma, and GlobeImposter use an RaaS business model. 

Paying Ransom

Making a ransom payment usually involves downloading a dark web browser to pay through a dedicated payment gateway. Most of the time, payments are made using cryptocurrency (such as Bitcoin) due to the untraceable nature.

Deciding whether to pay the ransom demand is a difficult choice. If you make a payment, you are essentially trusting the cyber criminals holding your data hostage to deliver on their promise of decryption. 

The FBI explicitly recommends against paying ransoms for this very reason: because a ransom payment never guarantees the decryption of data. 

That said, more than half (56 percent) of ransomware victims paid the ransom to restore their data in 2020. According to a global study of 15,000 consumers, 17 percent of those who paid the ransom did not secure the return of their stolen data. 

In the future, paying ransom to cyber criminals may result in additional fines. Currently, the U.S. Treasury Department is exploring financial penalties to organizations who pay a ransom to recover their data because the payments fund future extortion and encourage new attacks.

How to Protect Your Organization From Ransomware

It is impossible to block ransomware completely at its two most common points of entry: email and websites. You can, however, take steps at the system level to reduce ransomware attacks and cyber threats.

The most effective deterrent to ransomware is to back up and verify your system regularly. Still, because a ransomware attack may delete or encrypt your backed up data, you may find yourself looking for other options to further protect your organization. 

Here are some things you can do to better protect your organization from ransomware:

• Educate employees. Organizations should conduct regular training to help employees avoid common malware pitfalls because ransomware often infects a system through email attachments, downloads, and web browsing.
• Conduct regular data backups. Storing backups offline or offsite so that they cannot be accessed through your network is critical to protect your data. Verify that the data backup process works in your environment by periodically checking that files can be accessed from your backup device, removing backup media from networked devices, and avoiding popular online backup solutions that are also vulnerable to ransomware attacks.
• Restrict code execution. By limiting access control, ransomware that is designed to execute from temporary and data folders will not be able to access these folders. 
• Restrict administrative and system access. Decreasing user accounts and terminating all default system administrator accounts can create an extra roadblock for some strains of ransomware that are designed to use a system administrator account to perform their operations. 
• Maintain and update software. Pay particular attention to your security, antivirus, and anti-malware software to protect against (or assure early detection of) ransomware. 

If you do become the victim of a ransomware attack, consider the following steps:

• Take a snapshot of your system.
• Shut down your system.
• Identify the attack vector.
• Block network access to any identified command-and-control servers used by ransomware. 
• Notify authorities. 

How ZenGRC Can Help

As your organization looks for ways to protect itself against the threat of ransomware — and especially as RaaS contributes to its rise in efficacy and popularity — you might want to consider a governance, risk, and compliance (GRC) tool to help keep your data safe. 

ZenGRC from Reciprocity is a risk and workflow management software with an intuitive, easy-to-understand platform that keeps track of your workflow, and also lets you identify areas of high risk before that risk has manifested as a real threat.

Similarly, ZenGRC helps you stay compliant with cybersecurity frameworks, which therefore protects you from RaaS. 

With ZenGRC, a team of cybersecurity professionals is always looking out for your organization and its assets to make sure you get the best protection against security breaches and cyberattacks. 

For more information about how ZenGRC can help your organization protect itself against ransomware and RaaS, contact us for a demo today.