If you aren't familiar with ransomware, it's a piece of computer code that is part of a larger approach to infect an organization's network, spread to surrounding machines, encrypt or lock all discovered machines, and then extort money for the keys to unlock the encrypted machines. The two most common ransomware attacks involve either when an unwary user clicks on a file or link in an email that establishes an unauthorized access channel into the network or when a network vulnerability is discovered and a bad actor can inject the ransomware code into the system.

First appearing on Oct. 24, Bad Rabbit is a new strain of ransomware mainly spreading in eastern Europe, Ukraine and Russia especially, and in parts of Asia. Following WannaCry in May and then NetPetya in June, Bad Rabbit is the third most widespread outbreak this year. It spreads when users visit legitimate, but insecure websites, where the malware is disguised as an Adobe Flash installer. The website requests a user to click on a Flash update to run the requested video or file, so when the user opens the innocuous looking file, the Bad Rabbit malware enters the system and begins to spread and lock down all accessible machines. Infected machines then display a ransom note demanding Bitcoin payment (currently around $25-$300 per machine) within the next 40 hours.

Chris Duvall, director at The Chertoff Group, sat down with Inside Counsel to discuss emerging cyber threats like Bad Rabbit. He focuses on cybersecurity, and organizational risk management as part of the Security Services practice area, and works with his clients to help improve security operations and build enterprise-wide risk management capabilities.

“Ransomware, like Bad Rabbit, can have a destructive financial, operational, or reputation impact on organizations of all sizes, in any industry, and at all levels of maturity and we think that these incidents [like WannaCry, Petya and NotPetya] have scaled from mere nuisances to material adverse business events,” he explained. “Bad Rabbit provides a further example of two of the biggest threat trends we see for 2018–one, users continue to practice poor cyber hygiene and two, because of the lack of practicing good cyber hygiene, ransomware will continue to be the attack of choice for bad guys, from nation-states down to lone wolf hackers, given the ease with which it can be used to extort organizations … or merely wreak havoc on its systems and data.”

Today, ransomware prevents any access to infected machines and the data they contain. Encrypted, inaccessible data could include customer information, product inventory databases and other important, stored data needed to conduct business. Depending on the scope and downtime experienced, some organizations have recorded operating losses in the hundreds of millions of dollars. In fact, Maersk estimated losing over $300 million due to its NotPetya infection as operations were down for some organizations for over a week, including some hospitals in the U.K.

So, how can this be avoided?

According to Duvall, unfortunately, there is no easy way to avoid ransomware; all an organization can do is try to build an effective security program. However, there are four key considerations, including:

Understand your risk: Risk is comprised of threats to your organization, weaknesses or gaps bad actors can exploit, and the business impact if these weaknesses are exploited. An organization needs to thoroughly assess who would be interested in their sensitive and potentially lucrative data; how access could be gained; and what would result if this data was locked or destroyed.

Educate your workforce: Whether an organization is breached can merely come down to a single employee clicking on a single bad link. Employees should be trained to question incoming emails and phone calls if they don't recognize the sender/caller, aren't expecting the contact, or feel like the request is outside their comfort zone. Organizations should have a robust security awareness and education program to build a culture of security and foster employee vigilance.

Do the basics right: Many organizations spend money hand over fist for the latest new gadget. Having a technology that is powered by artificial intelligence or offers machine learning can assist the security team in addressing threats and vulnerabilities. However, making sure boring things like closing unnecessary ports, applying software patches in a timely manner, and preventing unauthorized machine-to-machine communications are even more important in the hunt to prevent ransomware access and spread.

Identity matters: In addition to the threat of ransomware. We need be leveraging the next generation of authentication technologies to validate identities in a way that is both stronger than passwords and easier for people to use. An organization can have all the bells and whistles but if a bad actor can easily guess or crack a password and just walk into the network through the front door then what is the point. Having a policy that requires employees, and others with access, to have strong passwords (i.e., 12+ characters in length with upper/lower case, numbers, special characters) and to change them periodically (every 30 to 60 days) is crucial. In addition, organizations should consider employing multifactor authentication across their enterprise for remote, web-based, and internal access points.

“Security is hard work,” he said. “There is a well-known expression, 'The good guys need to get security right every time, the bad guys only need to get it right once.'”

While a slight over-simplification, according to Duvall, the three most common ways bad actors breach companies are human error, weak access and authentication, and vulnerability management and patching. “The associated complexity and connectivity of our modern world, Bad Rabbit and other malware of similar ilk will continue into 2018 and beyond because it's easy, lucrative and really hard to address,” he explained.

According to Duvall, ransomware will continue to be a key threat to organizations of all sizes because it's easy, lucrative and challenging. Available ransomware code exists on the “dark web” and can be purchased by anyone with instructions on how to use it. This can be coupled with automated malware tools, also readily available, so that attackers just need to hit start and the program will search of vulnerability, inject ransomware and set up payment channels. Second, organizations experiencing a ransomware outbreak just want it to go away–they want to sweep it under the rug and have operations reestablished, and their customers none-the-wiser there was an incident, so they pay the ransom quickly. Lastly, the Internet is a blessing and a curse since it is a social, political and productivity enabler, but is also constantly evolving and creating new vulnerabilities for bad actors to attack and exploit.

He added, “The bad guys only need to find the one hole or flaw while the good guys need to try to fix them all. It can be losing battle unless security is baked into the organization's entire people, process and technology continuum.”

Amanda G. Ciccatelli is a Freelance Journalist for Corporate Counsel and InsideCounsel, where she covers intellectual property, legal technology, patent litigation, cybersecurity, innovation, and more.