Scientists at the University of Florida (UF) say they have developed software that can stop the growing problem of ransomware in its tracks. In the response of this news, security experts provides an insight on this research below.
Richard Cassidy, cyber security evangelist at Alert Logic:
Whilst the step taken by researchers at the University of Florida are indeed a novel way in which to detect and contain ransomware, it doesn’t serve as the “silver bullet” for ransomware as a whole. There are new variants being written all the time and ransomware writers will indeed take the time to dissect and understand how this new technology operates, creating versions that will attempt to either bypass detection, or at the very least search more effectively for likely sensitive files, before encrypting them, with the hope of having the biggest impact of securing a ransom payment. If the technology proposed allows the ransomware to start encryption of a few files, then it’s a game of averages on whether or not those files that are affected are of critical importance to the business.
Then there’s the challenge with ransomware evolving to operate below the OS, perhaps infecting host controllers, or running at lower levels than the software attempting to detect it is; here we are talking about the most targeted versions of ransomware, that simply can’t be detected by mass technology capabilities, until it’s infected the targeted assets and already set about its functions, either by communicating back to its command and control network, or by operating on a timed basis, threatening to delete all data if payment isn’t made. These represent emerging threats that the industry is working hard to identify, collaborating across multiple technologies, to be more effective together.
Overall however, is the age old principle that ransomware is mainly a social engineering threat, that enters the front gates of our network and devices, by way of phishing e-mails or malicious links embedded in documents, requiring the targeted user to interact with them. If users remained better educated on ransomware attack vectors and increased vigilance on not only the communication they are receiving, but the sites they visit; we’d go a far greater distance in preventing ransomware overall”
Simon Crosby, CTO and co-founder at Bromium:
Mark James, Security Specialist at ESET:
Don’t get me wrong, I wholeheartedly welcome anything that will help the victim but there are lots of things we can already do to protect against ransomware. It’s always mentioned time and again but backup and disaster recovery will protect you against ransomware every time. It can be low cost, it can be easy, it’s available now and anyone can get it and use it. Multi layered protection is the best way to combat modern day threats, those layers will include, internet security software, firewalls, backup software, updated hardware and operating systems, knowledge and of course common-sense. All these things are available to everyone reading this right now to protect your very valuable often priceless memories or data.”
Javvad Malik, Security Advocate at AlienVault:
“One of the biggest challenges is the variety of different ways ransomware operates. Written and executed in different ways. Currently, the best way to detect ransomware is by implementing a unified approach that looks for different behaviours across the network and host machine. This includes communication established with command and control centres or files are changed locally. In order to stay up to date with the methods and infrastructure that attackers are using, timely and reliable threat intelligence plays a crucial role.
“This is particularly important as attackers will often change their tactics in response to evolving defences, in the classic cat-and-mouse game we have witnessed in cyber security over the years.”
Jim Tyer, EMEA channel director at AppRiver:
David Gibson, VP of strategy and market development at Varonis:
Michael Patterson, Founder and CEO at Plixer:
“This threat is real and growing. If the tea
“Many of our enterprise customers have shared stories regarding ransomware infections – the infected machines are a complete loss and must be reinstalled. Seldom do they pay the ransom although many companies do. ”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.