Guide Outlines Layered Ransomware Prevention and Recovery Controls
Summary
The guide recommends layered ransomware defenses, from phishing-resistant MFA and network segmentation to monitoring, incident-response planning, protected backups, and tested recovery procedures.
Key points
- Use email filtering and phishing-resistant MFA to reduce the risk of phishing and stolen credentials leading to access.
- Patch internet-facing systems, remove unsupported software, disable unnecessary services, and harden remote access.
- Limit administrative privileges and segment networks to restrict lateral movement and access to critical systems.
- Monitor endpoint, identity, email, network, and application activity, with clear procedures to escalate suspicious signals.
- Keep backups separate from standard administrative paths, protect them with strong authentication, and consider immutable, offline, or off-site copies.
- Test restoration and incident-response plans, including recovery of identity, networking, and other dependencies.
Article Details
- Defense Focus
- Use layered controls to prevent ransomware entry, detect and contain compromise before encryption or extortion, and maintain reliable recovery capabilities.
- Detection Methods
- Analyze suspicious email attachments in a sandbox.
- Inspect and rewrite email URLs, then check their destinations.
- Monitor sign-ins, administrator activity, endpoints, networks, and applications for suspicious behavior.
- Investigate phishing attempts, malware detections, suspicious sign-ins, unusual administrator activity, and EDR tampering as potential early warning signals.
- Gather and review relevant endpoint, identity, email, and network data to investigate alerts.
- Verify backup integrity and conduct restoration tests to identify recovery dependencies.
- Data Sources
- Endpoint activity and EDR alerts
- Identity, sign-in, and administrator activity
- Email messages, attachments, and URLs
- Network activity
- Application activity
- Backup integrity and restoration-test results
- Platforms
- Microsoft 365
- Defensive Actions
- Use advanced email filtering, attachment analysis, sandboxing, URL inspection, and post-delivery response.
- Require phishing-resistant MFA, prioritize administrators and high-risk areas, and remove outdated authentication methods.
- Patch internet-facing systems promptly, remove unsupported software, disable unnecessary services, and harden remote access.
- Apply least privilege, separate administrative accounts, limit administrator access, and review service accounts and shared permissions.
- Segment networks and restrict unnecessary communication with critical systems, including identity, file, virtualization, and backup systems.
- Escalate and investigate suspicious activity before an attacker gains further access.
- Keep backups separate from standard administrative paths and protect them with immutable, offline, or off-site copies and separate privileged access.
- Preserve recovery documentation and test restoration, business continuity, and disaster recovery procedures.
- Maintain an out-of-band way to reach key contacts and recovery information, and exercise the incident-response plan.
MITRE ATT&CK
T1003 · OS Credential DumpingThe article notes that attackers may dump credentials after compromising an account.T1078 · Valid AccountsThe article describes attackers using stolen login details and replaying stolen passwords to gain access.T1486 · Data Encrypted for ImpactThe article describes ransomware encrypting files as a late-stage impact.T1490 · Inhibit System RecoveryThe article describes attackers disrupting or targeting backups to impede recovery.T1562.001 · Disable or Modify ToolsThe article describes attackers turning off security tools and tampering with EDR.T1566 · PhishingThe article identifies phishing as a common ransomware entry route and discusses malicious email attachments and URLs.
Vendors
Products
365 Total ProtectionWithin a broader Microsoft 365 approach, Hornetsecurity 365 Total Protection can combine email security capabilities with additional options such as backup, security awareness, permission management and complianceAdvanced Threat Protection (ATP)Hornetsecurity Advanced Threat Protection (ATP), for example, uses mechanisms such as sandbox analysis of suspicious attachments.Microsoft 365 Apps for EnterpriseFor Microsoft 365 environments, advanced email filtering should look beyond basic spam and malware signatures.
Industries
HealthcareSpecial Considerations for Healthcare and Other High-Impact EnvironmentslogisticsClinical, manufacturing, logistics, utilities, and other safety-critical environments may need to keep essential services running while isolating or restoring systems.ManufacturingClinical, manufacturing, logistics, utilities, and other safety-critical environments may need to keep essential services running while isolating or restoring systems.UtilitiesClinical, manufacturing, logistics, utilities, and other safety-critical environments may need to keep essential services running while isolating or restoring systems.