18/05/2017
Best practices to prevent RANSOMWARE attacks:
1) Maintain updated Antivirus software on all systems.
2) Check regularly for the integrity of the information stored in the databases.
3) Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements,
(backdoors /malicious scripts.)
4) Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems
5) Establish a Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email
spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
6)Keep the operating system third party applications (MS office, browsers, browser Plugins) uptodate
with the latest patches.
7)Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA% and
%TEMP% paths. Ransomware sample drops and executes generally from these locations.
8) Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally,
this data should be kept on a separate device, and backups should be stored offline.
9) Don’t open attachments in unsolicited emails,even if they come from people in your contact list, and never click on a URL contained in an
unsolicited email,even if the link seems benign. In cases of genuine URLs close out the email and go to the organization’s website directly through browser
10) Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
11) Network segmentation and segregation into security zones help protect sensitive information and critical services. Separate administrative
network from business processes with physical controls and Virtual Local Area Networks.
12) Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
13) Disable remote Desktop Connections, employ leastprivileged accounts.
14) If not required consider disabling, PowerShell /windows script hosting.
15) Restrict users' abilities (permissions) to install and run unwanted software applications.
16) Enable personal firewalls on workstations.
17) Implement strict External Device (USB drive) usage policy.
18) Employ dataatrest and dataintransit encryption.
19) Consider installing Enhanced Mitigation Experience Toolkit, or similar hostlevel Antiexploitation tools.
20) Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
21) Carry out vulnerability Assessment and Pe*******on Testing (VAPT) and information security audit of critical networks/systems, especially
database servers from CERTIN empaneled auditors. Repeat audits at regular intervals.
22)Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of
fraud to CERTIn and Law Enforcement agencies
Generic Prevention Tools:
Sophos: Hitman.Pro
https://www.hitmanpro.com/enus/surfright/alert.aspx
Bitdefender AntiCrypto Vaccine and AntiRansomware(discontinued)
https://labs.bitdefender.com/2016/03/combinationcryptoransomwarevaccinereleased/
Malwarebytes AntiRansomware(formely CryptoMonitor)
https://blog.malwarebytes.com/malwarebytesnews/2016/01/introducingthemalwarebytesantiransomwarebeta/
Trendmicro Ransomware Screen Unlocker tool:
https://esupport.trendmicro.com/enus/home/pages/technicalsupport/1105975.aspx
Microsoft Enhanced mitigation and experience toolkit(EMET)
https://www.microsoft.com/enus/download/details.aspx?id=50766
***** Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
