Thermo Fisher’s Matt McKnew Discusses Ransomware Evolution and Insider Threats

Summary

Thermo Fisher incident response manager Matt McKnew discusses how playbooks and documentation improve response, ransomware’s shift to business-like operations, insider threats exploiting weak processes, and DPRK fake IT-worker scams.

Key points

McKnew says incident response playbooks, documentation, and more consistent procedures have helped speed response and reduce the prolonged impact of incidents.
He describes ransomware operations as increasingly sophisticated and business-like, with ransomware-as-a-service models enabling broader targeting and more operators.
McKnew cites Clop as an example, saying it used six zero-day vulnerabilities within the last year to achieve its objectives.
He says insider threats are increasing and often involve financial motives, including theft of intellectual property or misuse of access.
Insiders and external actors can exploit weak organizational processes, including HR and hiring; McKnew also points to DPRK fake IT-worker scams.
McKnew recommends investigating activity in an organization’s environment that does not make sense.