Ransomware: A Growing Cybersecurity Threat to Businesses

What is affected, what to do

Businesses are increasingly operating remotely and leveraging internet-connected technologies extensively for their business and operations. This move towards digitalisation has also increased the exposure of businesses to the rising risks of ransomware.

The available sources name no fixed version. Check the vendor guidance in the references below.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Businesses are increasingly operating remotely and leveraging internet-connected technologies extensively for their business and operations. This move towards digitalisation has also increased the exposure of businesses to the rising risks of ransomware. Ransomware targets victims by holding their data hostage and demanding ransom from the victims. In some instances, victims' data might be exfiltrated. Businesses may feel compelled to pay the ransom when they have no backups to restore business operations or when attackers demand ransom in exchange for not divulging sensitive business information. The recent spate of disruptive, high-impact ransomware attacks have elevated the profile of ransomware attacks from being a sporadic and isolated risk affecting a small number of devices or computer systems, to a wider scale threat that targets hundreds or even thousands of computers. This type of disruption would adversely impact businesses operations and business continuity. In some of these attacks, business operations were disrupted, not because the core business-critical systems were hit, but because the ransomware attack affected the IT systems that business operations were critically dependent on, and operations had to be halted. Attackers commonly gain access via phishing methods, such as phishing emails, or remote access tools that can allow them to gain access, move around the network, and find high-value targets to steal data and start the ransomware encryption or data exfiltration. The availability of Ransomware-as-a-Service has also made ransomware attacks much easier to deploy. Businesses need to take preventive measures to mitigate the risks and also be prepared to deal with a ransomware incident, before it happens. Preventive Measures Practise Good Cyber Hygiene and Back Up Critical Data As the tactics employed by ransomware threat actors are fundamentally the same, practising good cyber hygiene remains an important step in preventing a ransomware attack. Businesses need to secure and monitor their networks and systems closely for suspicious activities, and raise employees' awareness of cyber threats such as phishing. Businesses should also ensure that security patches are applied in a timely manner, especially for business-critical functions. Importantly, prepare a backup and recovery plan for critical data and perform offline data backups regularly. Identify and Protect Business-Critical Assets Businesses should prioritise the identification and protection of their core business-critical assets. Threat actors may use connections between the networks/systems to discover and access business-critical assets. As such, it is essential to understand how networks/systems and business-critical assets connect and depend on each other, to prevent ransomware from spreading as well as to respond and recover from cyberattacks more effectively. Implementing network segmentation can limit interactions with business-critical systems and prevent ransomware from spreading in the network, in case of an attack. Prepare Business Continuity Plans Businesses should also work out Business Continuity Plans (BCPs) with measures tailored for their business needs to minimise impact to their operations in the event of an attack. BCP drills should be conducted with operational departments and key decision-makers so that all relevant stakeholders are familiar with the drills. In addition, the BCP should also be updated when there are important changes in assets or stakeholders. Businesses will continue to be targeted as long as ransomware remains profitable. Businesses need to take preventive measures and mitigate the risks before it happens. The best method to prevent an incident is by securing networks/systems to make it hard for the attacker to breach the network. However, businesses that have been hit can recover more quickly and confidently if they have a well-developed BCP, have a good understanding of their assets and business-critical functions, and are able to execute business recovery procedures expediently. For more preventive measures and recovery steps, please visit our advisory on ransomware . References: https://www.cisa.gov/sites/default/files/publications/CISA_Fact_Sheet-Rising_Ransomware_Threat_to_OT_Assets_508C.pdf https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2021-009

Source: CSA/SingCERT