Ransomware Resilience Assessment

How does a Ransomware Attack work?

A ransomware attack can start with an untargeted infection of an individual system with commodity malware. The access to infected systems within an organization's networks can be sold multiple times in the cybercrime underground by initial access brokers. The value of initial access to networks varies depending on factors such as the privileges that have been obtained and the revenue of the organizations involved.

The level of access can first be expanded and ultimately monetized by encrypting files on all compatible assets in an organization's IT infrastructure by a ransomware group or affiliate. Many ransomware groups specifically target critical business processes through double extortion by targeting the availability of mission-critical systems and confidentiality of sensitive data to impose the maximum costs on organizations.

People

The human factor can be the weakest link in an organization's security, but it can also act as the first layer of defense against ransomware attacks. In the Ransomware Resilience Assessment, your employees' awareness is assessed through a controlled (simulated) phishing attack. Based on our extensive experience, we have developed various realistic phishing scenarios. The phishing simulation provides a measurable and repeatable way to determine how employees' awareness contributes to the organization's overall ransomware resilience. Through the assessment, we also offer guidance to employees on how they can recognize and report phishing e-mails in the future.

Process

To assess your organization's resilience against ransomware, Secura’s experts will ascertain how your business-critical processes are entwined with IT/OT assets and how they depend on the broader IT/OT environment. We will assess your cybersecurity maturity to provide clear insight into your current maturity scoring. The assessment builds on a ransomware-specific profile of the NIST Cybersecurity Framework and covers each of the stages of dealing with an attack: identify, protect, detect, respond and recover. Our Ransomware Resilience Assessment shows you the gaps to attain the desired maturity level.

Technology

Secura continuously monitors the tactics, techniques, and procedures that ransomware groups leverage to target organizations, and we apply the same modus operandi in our ransomware resilience penetration tests. By looking at your IT infrastructure through the lens of ransomware threat actors, we can provide you with actionable advice to cost-effectively defend mission-critical assets against the attack paths that pose the highest risks in ransomware attacks.

The scope of the penetration tests in the Ransomware Resilience Assessment includes the whole IT/OT infrastructure that supports an organization’s business processes. We can test your IT/OT infrastructure, whether it is on-premises, in the cloud of your choice, or a mixture of both.

Tabletop Ransomware Crisis Management

Assessing your ransomware resilience can help reduce the risks involved with a ransomware attack and plan accordingly. But few incident response plans survive first contact with an actual ransomware attack. In Secura’s tabletop ransomware crisis management, the operating procedures for handling a ransomware incident are practiced and evaluated through a realistic scenario. Lessons learned to provide valuable feedback to improve incident response plans and procedures.

Threat Modeling Workshop

Applications and systems are usually part of a chain of information processing systems. In the highly interactive threat modeling workshop with developers, architects, business owners, and other stakeholders, Secura helps to identify possible threats per component and interface. Potential threats include but go beyond ransomware. The workshop raises security awareness and collaboration amongst the stakeholders and can help them structurally identify risks that may otherwise remain hidden.

Behavior Review

Raising employee cybersecurity awareness is the first step to improving ransomware resilience. But psychology shows us that there is a gap between awareness and behavior. Secura’s behavior review assesses the three components of effectuating behavioral change in your employees: motivation, opportunity, and ability. The results of this assessment allow you to optimize your approach to stimulate behavioral change that raises the ransomware resilience of your organization.