Ransomware mitigations
1. Ransomware mitigations
Next, let’s have a look at some ways you can mitigate the threat of ransomware. Google Cloud provides multiple layers of protection against ransomware. Many of these layers of protection are fully automated and available by default, with nothing for you to configure or enable. For example, Google has global visibility into malicious sites and content. Every minute of the day, Google finds and labels another malware site, and warns incoming users of suspected malware. This makes detecting malware attacks very effective, and there is nothing for you to monitor or configure. Google also provides many end-user protections to help prevent ransomware from spreading to your resources. If you're a Gmail user, our security and filtering layers will prevent thousands of malicious attachments from ever reaching your organization’s inboxes. If something does reach your Inbox, Google Safe Browsing and our Chrome browser protects users by identifying potentially dangerous links in email and showing warnings if users do click on them. In Google Drive, all files will undergo a malware scan prior to any file download or file sharing attempt. There are also a few things you can do to help mitigate against ransomware and reduce the ramifications of an attack. These steps include: making regular backups, using IAM best practices, and leveraging the Cloud Data Loss Prevention API. How can you use regular backups to lower risk to your data? The bad news is ransomware often targets backups and destroys them as well to prevent data recovery. Therefore, you need to keep your backups safe by conducting regular data backups of your system and then storing the backups securely, in multiple, isolated repositories. Having durable, secure backups not attached to or accessible by your main systems, which will then not be affected should a ransomware attack occur, will allow you to have a mechanism to recover the data if it is destroyed or held hostage. Think of it as insurance. Restricting administrative and system access is always a best practice, and is especially helpful for lowering the risk of ransomware attacks. Some strains of ransomware are designed to use a system administrator account to perform their operations. With this type of ransomware, decreasing the number and scope of user accounts and closing all default system administrator accounts can create an extra roadblock. It is very common for ransomware to be designed to execute from temporary and data folders. If it cannot access these folders due to access control on service accounts, this could constitute a successful roadblock to data encryption. In the past, sensitive data has been accidentally exposed to the public by organizations via screenshots or other published documents. This data is often used by attackers to help gain the initial access to your systems. Preventing this exposure can help provide a roadblock to a ransomware attack before it ever happens. The Cloud Data Loss Prevention API (DLP API) can be used to scan all documents for sensitive data before publication, and can even automatically redact any sensitive data found.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.