Identifying the best server infrastructure security to protect against ransomware

Ransomware is becoming more costly, and the sophistication of attacks is only getting worse. Here are some helpful tips to not only prevent attacks, but to minimize the damage in case of a breach. If you've been paying attention to the news recently, you probably don't need to be convinced of the threat that ransomware poses to your data and the increasing need for strong server infrastructure security. A recent report from Cybersecurity Ventures estimated that the worldwide cost of attacks would jump from $5 billion in 2017 to $8 billion in 2018—and that figure is expected to reach $11.5 billion in 2019.

Spotlight

E-Safe Technologies

E-Safe technologies is the place to go for any IT needs or concerns that your business may have. As an elite IT Solutions provider in the Pittsburgh area, we have the best team out there and have been helping clients drive profits for over 25 years. Founded in 1989, E-Safe began with a mission to help small and medium-sized businesses like yours get a real return on their technology investments. Since then, we have remained dedicated to providing state-of-the-art IT support, service and products that allow our clients to get ahead of the competition and achieve greater success.

OTHER ARTICLES
Application Development Platform

Empowering Industry 4.0 with Artificial Intelligence

Article | February 29, 2024

The next step in industrial technology is about robotics, computers and equipment becoming connected to the Internet of Things (IoT) and enhanced by machine learning algorithms. Industry 4.0 has the potential to be a powerful driver of economic growth, predicted to add between $500 billion- $1.5 trillion in value to the global economy between 2018 and 2022, according to a report by Capgemini.

Read More
Application Development Platform

How Artificial Intelligence Is Transforming Businesses

Article | March 14, 2024

Whilst there are many people that associate AI with sci-fi novels and films, its reputation as an antagonist to fictional dystopic worlds is now becoming a thing of the past, as the technology becomes more and more integrated into our everyday lives. AI technologies have become increasingly more present in our daily lives, not just with Alexa’s in the home, but also throughout businesses everywhere, disrupting a variety of different industries with often tremendous results. The technology has helped to streamline even the most mundane of tasks whilst having a breath-taking impact on a company’s efficiency and productivity

Read More
API Management

The advances of AI in healthcare

Article | April 30, 2024

With the Government investing £250 million into the project, the Lab will consider how to use AI for the benefit of patients – whether this be the deployment of existing AI methods, the development of new technologies or the testing of their safety. Amongst other things, the initiative will aim to deliver earlier diagnoses of cancer. It is estimated that in excess of 50,000 extra patients could see their cancer being detected at an early stage, thus boosting survival rates. More specifically, a study has shown that AI is quicker in identifying brain tumour tissue than a pathologist.This would have a positive knock-on effect in other areas, such as enabling money to be saved (that otherwise would have been spent on further treatment) and reducing the workload of staff (at a time when there is a crisis in NHS workforce numbers).

Read More

Three Keys to Successful AI Adoption

Article | February 10, 2020

Over the past several years, we have begun to see the emergence of artificial intelligence (AI) in businesses. According to a study for the AI Index 2019 Annual Report, more than half of respondents report their companies are using AI in at least one function or business unit. Thirty percent report they have AI embedded across multiple areas of their business. As businesses continue to develop their understanding of what is possible with AI, we can expect to see a continued increase in AI adoption.

Read More

Spotlight

E-Safe Technologies

E-Safe technologies is the place to go for any IT needs or concerns that your business may have. As an elite IT Solutions provider in the Pittsburgh area, we have the best team out there and have been helping clients drive profits for over 25 years. Founded in 1989, E-Safe began with a mission to help small and medium-sized businesses like yours get a real return on their technology investments. Since then, we have remained dedicated to providing state-of-the-art IT support, service and products that allow our clients to get ahead of the competition and achieve greater success.

Related News

GandCrab Ransomware Slingers Target MSPs

Infosecurity Magazine | February 15, 2019

A software company has been forced to remind customers to patch a two-year-old flaw in a third-party plug-in, after reports it is being exploited to infect scores of companies with GandCrab ransomware via their managed security provider (MSP). The issue relates to CVE-2017-18362, a flaw which affects the Connectwise Manage plug-in for the Kaseya VSA remote-monitoring tool. ConnectWise Manage is a professional services automation (PSA) product popular among IT support staff in MSPs. “This vulnerability allows a remote attacker to execute arbitrary SQL commands against the Kaseya VSA database, which means they can create administrative users, change user passwords, or even create tasks to deploy software to all endpoints under management,” explained Chris Bisnett, co-founder of Huntress Labs. “This week an unknown attacker leveraged the vulnerable integration to attack MSPs and their customers by tasking all managed endpoints to download and execute a ransomware variant known as GandCrab. This type of attack is particularly devastating because the Kaseya RMM tool has remote administrative (SYSTEM) access to all managed endpoints leading to a quick and complete compromise of all customer assets.” The incident was first revealed in a Reddit post a few days ago with the user claiming if affected a “local mid-sized MSP with about 80 clients” — all of which were apparently infected. Kaseya was forced to issue an update on the ConnectWise plugin bug. “Kaseya takes security very seriously and recommends that all customers using the Connectwise Plugin for VSA upgrade to the newly released version of the Plugin immediately or alternatively remove all versions of this Plugin,” it stated. The news is yet another example of the lengths ransomware authors are now going to in order to get their wares on as many victim machines as possible.

Read More

Ransomware Sees Further Decline, Banking Trojan Use Steps Up

Infosecurity Magazine | February 07, 2019

Ransomware accounted for one tenth of 1% of all malicious email content in Q4, according to a new threat report from Proofpoint. It’s Q4 threat report found that banking trojans accounted for 56% of all malicious payloads in email in Q4, while remote access trojans (RATs) accounted for 8.4%. Proofpoint claimed that this marked a “significant change” for RATs, as in previous years they were rarely used by attackers. The report stated that email remains the top vector for malware distribution and phishing, while email fraud, also known as business email compromise (BEC), continues to grow rapidly. Ransomware message volumes dropped significantly from Q2 to Q4 “suggesting that ransomware campaigns did not generate sufficient returns for threat actors to continue distributing them at scale.” Speaking to the Risky Business podcast in November, Sherrod DeGrippo, Proofpoint’s director of threat research and detection, said that ransomware “has basically evaporated” after it was in the headlines for many months. “I probably attribute that to the fact that cryptocurrency is so difficult for the average consumer to use, and what we’ve seen instead is, back to cryptocurrency, they are bolting on crypto-miners to just about everything: commodity banking trojans, commodity RATs and keyloggers and pretty basic crimeware stuff,” she said. “We’re starting to see banking trojans have crypto-miners bolted on to them so they steal the money from the traditional bank account and then leave the crypto-miner behind.” In an email to Infosecurity, Ed Tucker, CISO and co-founder of Email Auth, Byte and Human Firewall, said that this research highlights that ransomware is actually less of a prevalent threat both to the individual and business, and criminals know that trojans work.

Read More

Ryuk Ransomware Takes Down Cloud Hosting Provider’s Systems

SDxCentral | January 02, 2019

A ransomware attack with ties to North Korea took down cloud hosting provider Data Resolution’s systems on Christmas Eve. The California-based company provides software hosting, cloud computing, and data center services for about 30,000 businesses worldwide. First reported by KrebsOnSecurity, the attackers used a compromised login account to infect servers with Ryuk ransomware. In August, Check Point threat researchers linked Ryuk to the North Korean Lazarus Group, also known as Hidden Cobra. This is the state-sponsored group believed to be behind the WannaCry attack in 2017. And over the weekend, Ryuk malware infected the Los Angeles Times’ Olympic printing plant in downtown Los Angeles. This attack delayed that newspaper’s Saturday editions as well as the West Coast editions of the Wall Street Journal and New York Times, which are also printed at that plant. Data Resolution did not immediately respond to a request for comment. According to security researcher Brian Krebs, the attack gave hackers control of Data Resolution’s data center domain, locking the company out of its own systems and forcing it to shut down its network. A Jan. 2 status update shared with customers said the cloud hosting provider is still working to restore email access and multiple databases for clients and is in the process of restoring service for companies that use it to host Microsoft Dynamics GP, a popular accounting and payroll software. Data Resolution reportedly told customers that no data was stolen.

Read More

GandCrab Ransomware Slingers Target MSPs

Infosecurity Magazine | February 15, 2019

A software company has been forced to remind customers to patch a two-year-old flaw in a third-party plug-in, after reports it is being exploited to infect scores of companies with GandCrab ransomware via their managed security provider (MSP). The issue relates to CVE-2017-18362, a flaw which affects the Connectwise Manage plug-in for the Kaseya VSA remote-monitoring tool. ConnectWise Manage is a professional services automation (PSA) product popular among IT support staff in MSPs. “This vulnerability allows a remote attacker to execute arbitrary SQL commands against the Kaseya VSA database, which means they can create administrative users, change user passwords, or even create tasks to deploy software to all endpoints under management,” explained Chris Bisnett, co-founder of Huntress Labs. “This week an unknown attacker leveraged the vulnerable integration to attack MSPs and their customers by tasking all managed endpoints to download and execute a ransomware variant known as GandCrab. This type of attack is particularly devastating because the Kaseya RMM tool has remote administrative (SYSTEM) access to all managed endpoints leading to a quick and complete compromise of all customer assets.” The incident was first revealed in a Reddit post a few days ago with the user claiming if affected a “local mid-sized MSP with about 80 clients” — all of which were apparently infected. Kaseya was forced to issue an update on the ConnectWise plugin bug. “Kaseya takes security very seriously and recommends that all customers using the Connectwise Plugin for VSA upgrade to the newly released version of the Plugin immediately or alternatively remove all versions of this Plugin,” it stated. The news is yet another example of the lengths ransomware authors are now going to in order to get their wares on as many victim machines as possible.

Read More

Ransomware Sees Further Decline, Banking Trojan Use Steps Up

Infosecurity Magazine | February 07, 2019

Ransomware accounted for one tenth of 1% of all malicious email content in Q4, according to a new threat report from Proofpoint. It’s Q4 threat report found that banking trojans accounted for 56% of all malicious payloads in email in Q4, while remote access trojans (RATs) accounted for 8.4%. Proofpoint claimed that this marked a “significant change” for RATs, as in previous years they were rarely used by attackers. The report stated that email remains the top vector for malware distribution and phishing, while email fraud, also known as business email compromise (BEC), continues to grow rapidly. Ransomware message volumes dropped significantly from Q2 to Q4 “suggesting that ransomware campaigns did not generate sufficient returns for threat actors to continue distributing them at scale.” Speaking to the Risky Business podcast in November, Sherrod DeGrippo, Proofpoint’s director of threat research and detection, said that ransomware “has basically evaporated” after it was in the headlines for many months. “I probably attribute that to the fact that cryptocurrency is so difficult for the average consumer to use, and what we’ve seen instead is, back to cryptocurrency, they are bolting on crypto-miners to just about everything: commodity banking trojans, commodity RATs and keyloggers and pretty basic crimeware stuff,” she said. “We’re starting to see banking trojans have crypto-miners bolted on to them so they steal the money from the traditional bank account and then leave the crypto-miner behind.” In an email to Infosecurity, Ed Tucker, CISO and co-founder of Email Auth, Byte and Human Firewall, said that this research highlights that ransomware is actually less of a prevalent threat both to the individual and business, and criminals know that trojans work.

Read More

Ryuk Ransomware Takes Down Cloud Hosting Provider’s Systems

SDxCentral | January 02, 2019

A ransomware attack with ties to North Korea took down cloud hosting provider Data Resolution’s systems on Christmas Eve. The California-based company provides software hosting, cloud computing, and data center services for about 30,000 businesses worldwide. First reported by KrebsOnSecurity, the attackers used a compromised login account to infect servers with Ryuk ransomware. In August, Check Point threat researchers linked Ryuk to the North Korean Lazarus Group, also known as Hidden Cobra. This is the state-sponsored group believed to be behind the WannaCry attack in 2017. And over the weekend, Ryuk malware infected the Los Angeles Times’ Olympic printing plant in downtown Los Angeles. This attack delayed that newspaper’s Saturday editions as well as the West Coast editions of the Wall Street Journal and New York Times, which are also printed at that plant. Data Resolution did not immediately respond to a request for comment. According to security researcher Brian Krebs, the attack gave hackers control of Data Resolution’s data center domain, locking the company out of its own systems and forcing it to shut down its network. A Jan. 2 status update shared with customers said the cloud hosting provider is still working to restore email access and multiple databases for clients and is in the process of restoring service for companies that use it to host Microsoft Dynamics GP, a popular accounting and payroll software. Data Resolution reportedly told customers that no data was stolen.

Read More

Events