Ransomware Defense Cisco Security Adrian Aron Consultant Systems

  • Slides: 18
Download presentation
Ransomware Defense Cisco Security Adrian Aron Consultant Systems Engineer Oct 2016

Ransomware Defense Cisco Security Adrian Aron Consultant Systems Engineer Oct 2016

Agenda Ransomware? The Anatomy of an Attack Video Cisco Ransomware Defense Solutions © 2016

Agenda Ransomware? The Anatomy of an Attack Video Cisco Ransomware Defense Solutions © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2

Ransomware is a Massive Market $1 B $209 M 1000% Size of the ransomware

Ransomware is a Massive Market $1 B $209 M 1000% Size of the ransomware market – $1 B and growing $209 M in Q 1 CY 2016 Yo. Y growth of 1000% since CY 2015 © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3

The Evolution of Ransomware Variants Cryptowall Fake Antivirus CRYZIP Redplus First commercial Android phone

The Evolution of Ransomware Variants Cryptowall Fake Antivirus CRYZIP Redplus First commercial Android phone Tesla. Cryptolocker Virlock Lockdroid Reveton 2001 2005 2006 GPCoder 2007 2008 2012 Reveton. A Ransomlock Qiao. Zhaz Bitcoin Network Launched © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2013 4 Dirty Decrypt Cryptorbit Cryptographic Locker Urausy 2014 Crypto. Defense Koler Kovter Simple Locker Cokri CTB-Locker Torrent. Locker Coin. Vault Svpeng Sam Locky 7 ev 3 n Ke. Ranger Petya Tesla. Crypt 3. 0 Tesla. Crypt 4. 1 2015 Tox Crypvault DMALock Chimera Hidden Tear Lockscreen Tesla. Crypt 2. 0 2016 Cerber Radamant Hydra. Crypt Rokku Jigsaw Power. Ware

How Ransomware Works EMAIL-BASED INFECTION ! Email w/ Malicious Attachment Ransomware Payload Encryption Key

How Ransomware Works EMAIL-BASED INFECTION ! Email w/ Malicious Attachment Ransomware Payload Encryption Key C 2 Infrastructure Files Inaccessible WEB-BASED INFECTION ! User Clicks a Link or Malvertising Malicious Infrastructure Ransomware Payload Encryption Key C 2 Infrastructure Files Inaccessible © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5

Play the Video: “Anatomy of an Attack” https: //youtu. be/4 g. R 562 GW

Play the Video: “Anatomy of an Attack” https: //youtu. be/4 g. R 562 GW 7 TI © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6

Let’s Review the Steps of the Attack © 2016 Cisco and/or its affiliates. All

Let’s Review the Steps of the Attack © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7

The hacker used a valid looking email to deliver a file to employees. Except

The hacker used a valid looking email to deliver a file to employees. Except the originating domain name wasn’t exact quallcart. com © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8

The hacker then built enough “trust” in the email to get employees to open

The hacker then built enough “trust” in the email to get employees to open the file. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9

The malicious file executed on the employee’s laptop. The first payload, is a ransomware

The malicious file executed on the employee’s laptop. The first payload, is a ransomware attack, used as decoy. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10

Ultimately, the hacker stole customer data & financial information from the organization. The side

Ultimately, the hacker stole customer data & financial information from the organization. The side payload, was used to exfiltrate data. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11

Ransomware Defense Solutions © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

Ransomware Defense Solutions © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12

Architectural Force Multiplier Ransomware defense + Extend Security off Network Open. DNS Umbrella +

Architectural Force Multiplier Ransomware defense + Extend Security off Network Open. DNS Umbrella + Protect Key Endpoints AMP for Endpoints + Reinforce the Perimeter NGFW with AMP Leverage the Network as a Sensor and Enforcer © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13

Cisco Email Security with AMP would have inspected the email and detected the malware.

Cisco Email Security with AMP would have inspected the email and detected the malware. Initial SPF, DKIM and DMARK checks can easily spot this type of e-mail. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14

Cisco AMP for Endpoints would have detected and blocked the ransomware on the laptops

Cisco AMP for Endpoints would have detected and blocked the ransomware on the laptops and prevented the PDF attachment from opening. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15

Cisco Umbrella and Firepower NGFW would have blocked the ransomware from calling out to

Cisco Umbrella and Firepower NGFW would have blocked the ransomware from calling out to the internet. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16

Simple Open Automated Effective Security © 2016 Cisco and/or its affiliates. All rights reserved.

Simple Open Automated Effective Security © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17