Preparing for a Ransomware Attack MCCA Global TEC Forum June 19, - - PowerPoint PPT Presentation

▶
preparing for a ransomware attack
SMART_READER_LITE
LIVE PREVIEW

Preparing for a Ransomware Attack MCCA Global TEC Forum June 19, - - PowerPoint PPT Presentation

Jun 08, 2023 30 likes •200 views

Preparing for a Ransomware Attack MCCA Global TEC Forum June 19, 2017 Monica Patel, IBM Aravind Swaminathan, Orrick, Herrington & Sutcliffe Darren Teshima, Orrick, Herrington & Sutcliffe What is ransomware? Malicious software

slide-1
SLIDE 1

Preparing for a Ransomware Attack

MCCA Global TEC Forum

June 19, 2017

Monica Patel, IBM Aravind Swaminathan, Orrick, Herrington & Sutcliffe Darren Teshima, Orrick, Herrington & Sutcliffe

slide-2
SLIDE 2

What is ransomware?

June 17 Orrick | 2

  • Malicious

software

  • Denies users

access to systems or data

  • Systems/data

held hostage until ransom is paid

  • Failure to meet

demands could result in data deletion

slide-3
SLIDE 3

Ransomware evolution

June 17 Orrick | 3

slide-4
SLIDE 4

Ransomware attack cycle

June 17 Orrick | 4

slide-5
SLIDE 5

Trends

June 17 Orrick | 5

  • $1 billion industry in 2016 and growing
  • Bitcoin value up 3x
  • Cryptoware

Blockers

slide-6
SLIDE 6

Reputational Impact is Costly

June 17 Orrick | 6

56% 40% 29%

Political Action (sign a petition, contact a politician Stop/Reduce Technology Use Social Activity (post to social media, write an op-ed or letter)

Source: Edelman Proprietary Study, 2014

Actions your customers take when you falter

74.8% 72.5% 80%

  • f consumers worry about the security of their personal information.

Temkin Group "Consumer Benchmark Survey"

  • f consumers don’t believe organizations care about their private data

and keeping it safe and secure.

HyTrust Inc., the Cloud Security Automation Company

  • f consumers believe failure to keep customer information secure has a significant

negative impact on trust in a company.

Edelman Trust Barometer: Financial Services Industry

slide-7
SLIDE 7

To pay or not to pay…

June 17 Orrick | 7

“The FBI does not support paying a ransom to the adversary. Paying a ransom does not guarantee the victim will regain access to their data; in fact, some individuals or organizations are never provided with decryption keys after paying a ransom. Paying a ransom emboldens the adversary to target other victims for profit, and could provide incentive for other criminals to engage in similar illicit activities for financial gain. While the FBI does not support paying a ransom, it recognizes executives, when faced with inoperability issues, will evaluate all options to protect their shareholders, employees, and customers.”

slide-8
SLIDE 8

Is it a breach?

June 17 Orrick | 8

Where PHI is “encrypted as the result of a ransomware attack, a breach has

  • ccurred because the PHI encrypted by the ransomware was acquired … and thus

is a ‘disclosure’ not permitted under the HIPAA Privacy Rule.” Notification may not be required if the entity can demonstrate a “low probability that the PHI has been compromised,”

  • lack of attempted or actual data ex-filtration,
  • mitigation based on disaster recovery and data backups
  • use of appropriate level of encryption

Must be highly diligent in their forensic analysis and risk assessment to take advantage of the notification exception:

  • Thorough investigation
  • Completed in good faith
  • Conclusions reasonable given circumstances
  • Documentation

Also consider state notification rules based on “access” to personal information, such as Connecticut, Florida, Kansas, Louisiana, and New Jersey

slide-9
SLIDE 9

Violation of FTC Act?

June 17 Orrick | 9

“A company’s unreasonable failure to patch vulnerabilities known to be exploited by ransomware might violate the FTC Act.”

  • - (Then) Chairwoman Edith Ramirez (2016)

Failure to address “pervasive security bugs” that leave systems vulnerable to malware will be a key factor in the FTC’s decision to open an investigation or pursue an enforcement action.

slide-10
SLIDE 10

Prevention Efforts

  • Increase employee awareness of ransomware and role in protecting the organization’s data
  • Patch operating system, software, and firmware on digital devices
  • Automatic updates to antivirus and anti-malware solutions and conduct regular scans
  • Manage use of privileged accounts—assign administrative access only where absolutely

needed and necessary

  • Configure access controls—users don’t need write-access to all information; read only ok
  • Disable macro scripts from office files transmitted over e-mail
  • Implement software restriction policies or other controls to prevent programs from executing

from common ransomware locations Business Continuity Efforts

  • Back up data regularly and verify the integrity of those backups regularly
  • Secure your backups. Make sure they aren’t connected to the computers and networks they

are backing up

What to do?

June 17 Orrick | 10

slide-11
SLIDE 11
  • 1. Prepare

– End user education

  • Consider performing periodic unannounced mock phishing exercises where the users

receive emails or attachments that simulate malicious behavior

  • End users should know who to contact and how to report possible ransomware attacks

– Have a clearly defined, up-to-date incident response plan – Back up data regularly

  • 2. Patch

– Good security hygiene – Create internal corporate policies that require end users to update patches quickly

In-House Counsel – What Should You Consider?

June 17 Orrick | 11

slide-12
SLIDE 12
  • 3. Monitor

– Maintain current antivirus and/or end point protection – Only grant permissions necessary that an end user requires to perform daily jobs

  • 4. Respond

– Detect – Analysis

  • Malware identification
  • Root cause analysis

– Containment – Recovery

  • Restore from back up

– Post-Incident Activity

  • What are the lessons learned?

In-House Counsel – What Should You Consider?

June 17 Orrick | 12

slide-13
SLIDE 13
  • Refresh incident response plan to address ransomware scenarios
  • Incorporate business continuity and disaster recovery plans into IRP
  • Conduct ransomware tabletop exercises
  • Engage forensic experts early; consider providers with ransomware

payment programs

  • Conduct regular risk and vulnerability assessments
  • Consider endpoint monitoring technologies
  • Insurance

Additional Considerations

June 17 Orrick | 13

slide-14
SLIDE 14
  • Cyber Extortion Coverage for Ransomware

– Provides coverage for ransom payment – Subject to certain conditions, including:

  • Insurer’s prior consent
  • Notification to law enforcement
  • Subject to a sublimit

– Definition of “currency”

  • Ensure it includes cryptocurrencies, like Bitcoin

Insurance Considerations

June 17 Orrick | 14

slide-15
SLIDE 15
  • Additional Cyber Coverages May Be Implicated

– First-party coverages in event ransomware disrupts business or destroys data, as opposed to simply locking down system – If ransomware is part of larger breach, and PII is compromised, breach notification and third-party liability coverage may be implicated

  • Notice to Insurer of ransomware: Data breach may be considered

“related,” subject to a single retention. Without notice of initial ransomware, there is a risk the data breach costs may be excluded

  • Check Non-Cyber Policies for Coverage: e.g., crime policies

Insurance Considerations (cont.)

June 17 Orrick | 15

slide-16
SLIDE 16

Thank You

16 June 17

Monica Patel

Senior Regional Counsel IBM

T 415 545 3246 E patelmo@us.ibm.com

Aravind Swaminathan

Partner Orrick, Herrington & Sutcliffe LLP

T 415 773 4286 E dteshima@orrick.com

Darren Teshima

Partner Orrick, Herrington & Sutcliffe LLP

T 206 639 9157 E aravind@Orrick.com

slide-17
SLIDE 17