Top 5 BCDR Strategies: Guarantees for Successful Ransomware Protection

Sodinokibi ransomware.[1] Implementing BCDR (Business Continuity and Disaster Recovery) essentials is crucial for an organization’s effective ransomware defense.

This post discusses five BCDR essentials every organization must-have for a robust defense against ransomware attacks.

1.

Incident Response Plan

An Incident Response Plan is the organization’s detailed action guide to respond promptly and efficiently to a ransomware attack.

For instance, when Bitdefender’s healthcare clients got hit by the REvil ransomware attack, their Incident Response Plan allowed them to deflect the attack without significant downtime.[2] A clear Incident Response Plan that is regularly exercised and updated is essential for mitigating the effects of a ransomware incident.

2.

Regular and Redundant Backups

Implementing regular and redundant backup of data is a strong defense against ransomware threats.

When the University of California at San Francisco was hit by a ransomware attack in June 2020, their regular backup practices enabled them to restore most of their systems without paying the demanded ransom.[3] Note that backups must be kept offsite or in the cloud to reduce susceptibility to ransomware infiltration.

3.

Recovery Objectives

Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are two critical recovery objectives in effective ransomware defense.

The RTO quantifies the time within which systems should be restored post-attack, whereas the RPO identifies how much data loss the organization can afford.

These metrics should be established, communicated, and tested regularly.

4.

Employee Training

According to Verizon’s 2020 Data Breach reports, phishing scams are the primary infection vector for ransomware attacks.[4] Consequently, employee training in cybersecurity best practices such as recognition of phishing emails, strong password practices and adherence to software patches/updates is a key component in the fight against ransomware.

5.

Continuous Monitoring

Implementing continuous monitoring and detection tools to prevent ransomware attacks is crucial.

Maze ransomware, which hit the city of Pensacola in 2019, could be contained due to their active monitoring systems.[5] These software monitor network traffic for any unusual activity, enabling early detection of an attack.

Conclusion

BCDR is a critical approach to safeguarding organizations’ operations and reputation from ransomware attacks.

However, it’s not a one-size-fits-all solution.

It requires a comprehensive understanding of the unique risks an organization faces and customizing the appropriate defenses.

Follow-Up Reading

[1] Incident Handlers Handbook, SANS Institute
[2] Simplifying disaster recovery with Google Cloud, Google Cloud Blog
[3] Ransomware Evolution, Microsoft Security Blog