Security is only as good as your threat intelligence

The best news about ransomware is that it is largely a preventable threat. A lot of reporting on ransomware focuses on the ransomware payloads, which can make it seem like an endlessly scaling threat of dozens of attackers, but what it really is, is a subset of attackers who use the same techniques but switch between available ransomware as a service payloads.

By focusing on the actors behind the attacks versus the payloads, we can show that most attackers who deploy ransomware aren’t using magical skills or developing bespoke zero-day exploits; they are taking advantage of common security weaknesses.

A lot of the attackers use the same techniques, so you can see where the threats overlap and apply mitigations for them. Almost every ransomware attack involves attackers gaining access to a highly privileged credential like a domain admin or a software deployment account – and this is something you can solve with built in tools like Group Policies, Event Logs, and Attack Surface Reduction (ASR) Rules.

In some orgs that have enabled ASR rules they saw a 70% reduction in incidents, meaning less SOC fatigue and less chances for attackers to gain initial access to chip away at their defenses. The organizations that are successful against ransomware are the ones who focus on this type of hardening.

Prevention work is essential.

One of the things I like to say is that prevention and detection are not peers. Prevention is detection’s guardian because it quiets the network and gives you the whitespace to find the most important things.

All-in-all, threat intelligence in the right hands makes the difference in preventing an attack or interrupting it automatically.

Learn more about how to protect your organization from ransomware, and read the full report.