1. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Ransomware: How to Avoid Extortion Matthew Walker – VP Northern Europe

2. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Examples of Ransomware

3. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Examples of Ransomware

4. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. About Ransomware

5. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. About Ransomware

6. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. About Ransomware

7. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. About Ransomware

8. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. About Ransomware 84% believe their company would be seriously damaged if it were successfully infected with ransomware

9. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. About Ransomware 31% admitted that if their corporate networks were infected they’d have no choice but to pay the ransom

10. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. How Does It Work? Delivery

11. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. How Does It Work? Delivery Phishing Email Drive-By Download BotnetMalicious App Malvertising

12. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. How Does It Work? Delivery InfectionDisable DefensesPhone HomeEncrypt Data FilesInstallation

13. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. How Does It Work? DeliveryInfectionDisable DefensesPhone HomeEncrypt Data Files Demand RansomSupport Services Installation

14. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. How Does It Work? DeliveryInfectionDisable DefensesPhone HomeEncrypt Data FilesDemand RansomSupport Services Release of Files Installation Pay Ransom

15. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. How Does It Work? DeliveryInfectionDisable DefensesPhone HomeEncrypt Data FilesDemand RansomSupport ServicesRelease of FilesInstallation Pay Ransom

16. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Recommendations Network Defenses NGFW, EDR, Threat Intel Endpoint Defense-in-Depth Patch and Configuration Management Application Whitelisting Data Encryption Device Control Antivirus Preparation Back-ups – follow 3 – 2 – 1 rule Staff Training User Training Post-Event Configuration Restoration Forensics Infrastructure Changes

17. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Recommendations AV Control the Bad Device Control Control the Flow HD and Media Encryption Control the Data Application Control Control the Gray Patch and Configuration Management Control the Vulnerability Landscape Endpoint Defense-in-Depth Successful risk mitigation starts with a solid vulnerability management foun- dation, augmented by additional layered defenses which go beyond the traditional blacklist approach.

18. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Recommendations AV Control the Bad Device Control Control the Flow HD and Media Encryption Control the Data Application Control Control the Gray Patch and Configuration Management Control the Vulnerability Landscape Patch and Configuration Management Eliminates the attackable surface area that hackers can target Central configuration of native system security controls such as firewalls and OS protections (e.g., ASLR, DEP, etc.) Improves endpoint performance and stability

19. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Recommendations AV Control the Bad Device Control Control the Flow HD and Media Encryption Control the Data Application Control Control the Gray Patch and Configuration Management Control the Vulnerability Landscape Application Whitelisting Extremely effective against zero-day attacks Stops unknown, targeted malware payloads, regardless of delivery mechanism Low performance impact on endpoints

20. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Recommendations AV Control the Bad Device Control Control the Flow HD and Media Encryption Control the Data Application Control Control the Gray Patch and Configuration Management Control the Vulnerability Landscape Data Encryption Protects data in cases of theft or accidental loss Makes lateral data acquisition more difficult for APTs Required by almost all regulations

21. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Recommendations AV Control the Bad Device Control Control the Flow HD and Media Encryption Control the Data Application Control Control the Gray Patch and Configuration Management Control the Vulnerability Landscape Device / Port Control Can prevent unauthorized devices from delivering payloads Can stop specific file types from being copied to host machines Stops a common delivery vector for evading extensive physical and technologic security controls

22. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Recommendations AV Control the Bad Device Control Control the Flow HD and Media Encryption Control the Data Application Control Control the Gray Patch and Configuration Management Control the Vulnerability Landscape Antivirus Stops “background noise” malware May detect reused code and evasion techniques Will eventually clean payloads after signatures are developed

23. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Recommendations Network Defenses NGFW, ETDR, Threat Intel Endpoint Defense-in-Depth Patch and Config Management Application Whitelisting Data Encryption Device Control Antivirus Preparation Back-ups – follow 3 – 2 – 1 rule Staff Training User Training Post-Event Configuration Restoration Forensics Infrastructure Changes

24. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. Summary Ransomware, cyber-extortion, digital blackmail – it’s evil and it’s here Implement the security tech and training ahead of time to minimize the chances of your data being held for ransom and to maximize your ability to recover quickly Have an Incident Response Plan in place

25. ©2015 HEAT Software. All rights reserved. Proprietary & Confidential. www.heatsoftware.com www.lumension.com