Senate Releases Report on Russia’s Ransomware Attacks, Attempts on U.S. businesses

Summary:

America’s Data Held Hostage is the name of the just-released report by the U.S. Senate’s Committee on Homeland Security. The report provides a profile of three anonymous companies of varying sizes that were all attacked by the Russia-based ransomware group REvil and the experiences of those companies during the incident response. Highly publicized ransomware attacks cited were the ones to the Colonial Pipeline, the nation’s largest fuel pipeline that supplies 45 percent of the fuel to the east coast that was shut down last May. And JBS, the world’s largest supplier of beef, shut down meat plants in six states. JBS ended up paying an $11 million ransom according to the report.

Additional Discussion:

The key findings include:

• All organizations, regardless of size and sophistication, are susceptible to ransomware attacks.
• Ransomware gangs often use phishing attacks to gain initial access to victim networks.
• In past ransomware attacks, multifactor authentication, zero trust principles, and network segmentation helped prevent attackers from gaining access to more sensitive data in a victim’s networks.
• Maintaining offline backups and a well-defined incident response plan helped victims resume critical operations quickly without paying a ransom, when attackers did get in.
• The laws and regulations at the time discouraged victims from sharing information with other potential victims that could prevent future ransomware attacks.
• In two cases reviewed in the report, the Federal Bureau of Investigation prioritized its investigative and prosecutorial efforts to disrupt attacker operations over victims’ need to protect data and mitigate damage.
• Until recently, there was no federal agency charged with collecting and tracking reports of cyber incidents to prevent and mitigate future attacks.

Associated Files:

 Americas Data Held Hostage