Our Insights

Valuable information we share.

Cyber Kill Chain & Ransomware

Posted by Nino Vales | Aug 20, 2018 9:46:05 AM

The Cyber Kill Chain model breaks down a Ransomware attack in seven stages. This article will give you an understanding of our security solutions and what is effective based on the current stage of the Ransomware. 

 

Cyber Kill Chain stages

 

Reconnaissance

The threat actor or attacker will gather all public information available for your organization. An example of which is the website's contact us page, phone numbers, or domain WHOIS information. Some attacks involve attackers running an automated script to guess the email addresses associated with the domain.

Recommended:

  • Better security practice and handling of public information
  • Cyber Security training to identify Phishing attempts

 

Stage

Once the threat actor gathers enough information, it now prepares to launch the attack. An example of which is a Phishing email with malicious attachments or URL's to be sent out to the users of the targeted organization.

Recommended:

  • User Security training to identify Phishing emails from legitimate emails (Cybersecurity training – KnowBe4)

 

Launch

If the user opens the attachment from a Phishing email or clicked the link then it could execute a script to infect the system.

Recommended:

  • Cisco Umbrella to filter DNS traffic
  • Meraki MX Firewall with intrusion prevention system
  • Office 365 spf, dkim, or dmarc records

 

Exploit

The stage where the malicious script looks for the vulnerability of the system. An example is an unprotected, unpatched system or outdated firmware. A network with a weak firewall system is severely at risk.

Recommended:

  • Cisco Umbrella for blocking suspicious traffic
  • Meraki MX Firewall with Intrusion Prevention System

 

Install

The stage where the Ransomware payload is installed on the vulnerable system. Workstations with no real-time antivirus protection are at risk.

Recommended:

  • Host-based antivirus or anti-malware products such as Webroot, Trend Micro, or Cisco AMP

 

Callback

The infected system contacts the attacker's command and control center to retrieve the key to encrypting the user files. It is also called as the Botnet command center.

Recommended:

  • Cisco Umbrella to block suspicious categories like newly created domains or known Botnet locations
  • Meraki MX Firewall to filter out suspicious traffic

 

Persist

The stage where the system files are already encrypted and a ransom note keeps popping up requesting the victim to pay the ransom.

Recommended:

  • A security professional to assist with assessing the impact and removal of the Ransomware
  • Meraki MX Firewall that logs all unusual traffic produced by the infected system to help with the investigation

 

You might notice that certain security solutions cover several stages of the Cyber Kill Chain model. Implementing these solutions will give you a better chance of avoiding a Ransomware infection.

In addition to this, having a reliable backup solution will save your files in case Ransomware still manages to infect your system.

This model is not perfect, but it gives your business better chances of stopping a Ransomware attack. The cost of these security solutions is minimal compared to the downtime or paying a ransom to recover your files.

Topics: Ransomware, Cyber Security, Phishing, Network Security

Written by Nino Vales

Nino regularly writes about tips and articles about Cyber Security. He currently holds dual CCNA certification in Routing and Switching, and CyberOps. During his free time, he loves to go fishing and play basketball. He is a huge NBA fan and loves to collect limited edition basketball sneakers and jerseys. He currently plays NBA 2K19 in his PS4.

ASK US HOW WE CAN SERVE YOU

Clear Concepts is a team of passionate professionals, proud of what we do — we want to make a positive impact on your operation.

Let us hear your technology challenges and opportunities so we can help you get the most out of your technology investment, on-premise and in the cloud. Contact us today.