Cyberattacks against mid-market and enterprise organizations are on the rise. From man in the middle (MitM), distributed denial-of-service (DDoS) and SQL injections, to zero-day exploits and phishing, cyberthreats are getting more sophisticated, more prevalent and more costly. But one type of cybercrime reigns supreme: ransomware.

Not-so-fun facts about ransomware today:

• Ransomware cost the world $20 billion in 2021. That number is expected to rise to $265 billion by 2031.
• In 2021, 37% of all businesses and organizations were hit by ransomware.
• Recovering from a ransomware attack cost businesses $1.85 million on average in 2021.
• Out of all ransomware victims, 32% pay the ransom, but they only get 65 percent of their data back.
• Only 57% of businesses are successful in recovering their data using a backup. Source: Cloudwards

COVID-19 is not the only pandemic to emerge and gain a global stronghold as we push on into the 2020s. Ransomware has its tentacles everywhere. No network – corporate or personal – is immune. The financial damage being inflicted, especially at the corporate level, is only getting more and more severe. It has the potential to bring some institutions to their knees and send ripples through the global economy, eventually impacting the everyday consumer.

If we’re to right the ship, the castle walls around our ever-expanding networks must become stronger, more dynamic and more intelligent. It also requires vulnerable entities to step into the realm of psychology. What’s motivating these threat actors? What do we as an organization have that they want?

Stopping Ransomware Just as we wear masks and get vaccinated to protect ourselves from the threat of contracting COVID-19, we must take the proper precautions to limit or eliminate the possibility of a ransomware attack.

Know Your Enemy For most companies, the enemy (or hacker) just wants money. More rarely, they’re after corporate data for some personal gain – again, that could be to sell it or leverage it for other malicious initiatives that could be politically or ideologically motivated. Even more rarely, they’re just looking to tarnish your brand’s reputation.

Regardless of their intent, however, there is one simple commonality: they want to breach your network through clandestine means. The emphasis is on the network even if that network is not physical. Today, it doesn’t need to be. In 2022, your network is merely where your corporate endpoints are in use, and ultimately where data accessed via those devices is stored.

The attempt to understand the enemy has given rise to threat intelligence services that can help you profile your attackers. Such tools can determine whether these individuals have a hold on your network, endpoints and/or users. But threat intelligence alone isn’t enough – organizations need to know themselves, which requires a unified stack of security technologies and tactics that when deployed in conjunction with one another can thwart even the most sophisticated ransomware attack.

Know Your Organization Corporate endpoints serve as the initial entry points to any corporate network. These devices store proprietary, sensitive data – the hostage in this hostage taking scenario. To effectively secure the network requires instituting a bevy of endpoint security measures as part of a larger security posture strategy. Frameworks such as the CIS Critical Security Controls outline these best practices.

Ultimately, however, organizations can start with these basics:

• Use Multi-Factor Authentication (MFA) when possible; discourage the use of corporate applications that do not allow for MFA activation; use a password manager when MFA is not available.
• Have a mechanism to isolate any infected machine in use across your network to prevent lateral movement and further spread. Network access control (NAC) solutions have been purpose-built to do just this.
• Employ an email content inspection software that proactively inspects all links and attachments within incoming emails; this aids in stopping malware via phishing attempts.
• Deploy an Endpoint Detection & Response (EDR) program on all machines – managed devices, BYOD & IoT / OT – that runs 24/7 with automatic system updates.
• Ensure you’ve instituted proactive device remediation for all connected endpoints that can automatically update firewalls, antivirus and VPN services in use. NAC also incorporates this functionality.

If you follow those principles, you can win every battle. As legendary military strategist Sun Tzu wrote in his classic work, The Art of War: “If you know the enemy and know yourself; you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”

In early December 2021, a significant vulnerability in a common piece of Java-based code by Apache set the world on fire…at least for IT security professionals. Within 24 hours of disclosure, leading software companies like IBM, Oracle, Amazon, and Cisco went into damage control, seeking to assess the level of potential damage they had and could expect to sustain, and frantically working on patches to prevent their customers’ data from being siphoned off and sold to the highest bidder. The event was fitting for 2021, a year marked by disinformation, confusion and fear.

“The log4j vulnerability is the most serious vulnerability I have seen in my decades-long career,” Jen Easterly, U.S. Cybersecurity and Infrastructure Security Agency director, said in a interview on CNBC.

As December 2021 dragged on, related flaws continued to surface, sending those same software companies back to the drawing board to repackage and test yet another series of patches for customer distribution. This after communicating initial patches to customers that often took a whole weekend or more to implement. It didn’t bode well for a happy holiday season for already resource-strapped IT teams who had been dealing with a plethora of network security issues for two years brought on by the COVID-19 pandemic and the overnight surge of remote workforces.

Depending on the version and the type of application, the log4j vulnerability’s scope and severity ranged from focused and moderate to widespread and critical. Some vendors were hit harder than others, such as Cisco, whose Identity Services Engine system saw more than 120 configurations affected. Others, like Microsoft, capitalized on the opportunity, rolling out solutions to proactively seek out and manage affected files, software, and devices impacted by log4j.

Widespread & Hard to Pin Down

The extent of the impact of the log4j vulnerability was in many ways foreseeable. The root cause: human “ingenuity” that could otherwise be called laziness. Rather than reinventing the wheel by creating a new set of code for each application that is developed, software engineers now often patch together existing libraries and packages for shared functions to generate much of the codebase that runs critical applications.

Like many noteworthy cyber incidents before it, the Log4j vulnerability helped us open our eyes to just how many software dependencies exist across enterprise systems — no matter if they are designed for security, operations, or sales. It also highlighted to us just how hard it is to mitigate and develop stopgaps for these vulnerabilities when they are so far-reaching and barely understood, especially in the early days of disclosure.

While the ability to utilize the same code across many systems does offer value in terms of time to market, the problem is that many prefabricated libraries and open-source projects are interdependent, resulting in a web of dependencies that drill down many layers. Inevitably, this creates a scenario where indirect dependencies that can be nearly impossible to identify and troubleshoot when a vulnerability is unearthed.

For the average Joe IT manager, this just means that the software you licensed was likely built using common third-party code you’re not even aware of that likely contains some vulnerabilities. Multiply this shared code across other enterprise systems in your stack – and queue the headaches.

Avoiding Issues Like Log4j as an End-User

Java is a programming language that’s been around for a while and is commonly found in older on-premises software. As such, it should not come as a surprise that the classic tech giants of the world wasted no time prioritizing the log4j vulnerability – they had billions of dollars in revenue at stake across their suites of legacy software. And to make matters worse, the issue didn’t just impact Java-based systems, but also Java components and development frameworks that rely on it including Apache Struts2, Apache Solr, Apache Druid, Apache Flink, ElasticSearch, Apache Kafka and many others. We’re talking about tens of millions of impacted systems in use at any given moment today.

How to avoid such widespread vulnerabilities is more than a question of choosing which apps are programmed with which language(s) – software engineers can debate the efficacy of each until they are blue in the face. Rather, it’s a question of how to consume enterprise software. For organizations more reliant on cloud native software-as-a service applications, IT employees almost certainly experienced fewer lost weekends dealing with the log4j problem.

This is because SaaS has a shared responsibility model, whereby both the vendor and the customer are responsible for the security of the application in use. The onus is on the SaaS vendor to deliver secure products and services, while the responsibility for configuring, managing, and using the product lies with the customer. In the case of Log4j, most of the heavy lifting falls on the SaaS vendor. They must ensure that their products are not affected. If they are, it is up to them to provide transparency into how the system is being patched and how the vulnerability is being mitigated.

While this differentiation seems simple, implementing a cloud-first IT strategy – no matter if universal or by function – can mean retaining IT talent by avoiding burnout, optimizing your IT budget by eliminating the need for third-party professional services, and so much more.

For IT and security teams with limited staff and tight budgets, cloud-native software-as-a-service (SaaS) security products offer tremendous value. Some CIOs have even mandated that new security tools be delivered in the cloud where possible. Some vendors with older on-premises products have tried to sneak in their products by claiming they are now “in the cloud,” but the truth is that that is a façade. Let’s call these products “faux” cloud security to contrast against products that are truly “cloud native.” Vendors of faux cloud products hope that with a little marketing smoke and mirrors, they can use some “cloudy” language and potential buyers will not know the difference. When we say faux cloud, technically speaking, we mean that the vendor is just allowing the customer to host their on-premises product in the customer’s public cloud account. This means the customer still must install, configure, deploy, maintain, update, and eventually decommission that product. In other words, you as the customer must do all the work. The only “cloud” aspect of this arrangement is that you can do all the work on a server you are renting (that is, paying for) from AWS, Azure, Oracle, Dell, etc.

Faux Cloud Security in the Real–World

A real-world example of this software sleight-of-hand is Cisco’s Internet Security Engine (ISE). Cisco delivers ISE as a virtual appliance to handle network access control (NAC) – a critical component of any effective cyber security stack. As of ISE’s latest version, a customer can deploy the software in their own AWS or Azure accounts. That is the long and short of it, however. The well-known challenges of setting up ISE – or any other network security appliance – remain. It is difficult to get your ISE server configured properly, ensuring it communicates with all your network equipment, even after having committed over 1,200 pages of ISE documentation to memory.

Cloud Native Reduces the Hassles

In contrast, a truly cloud-native solution allows the customer to sign up through a web page, configure as needed, and move on – the application just works out-of-the-box. Period. Now, that’s the easy part. As your organization consumes a cloud service, it does not have to concern itself with nagging issues and questions along the way common with on-premises software (e.g., How do we roll out patches and upgrades? Is there a security vulnerability in the operating system? Who is handling system backup?). You, as the end-user, have historically been responsible for these items with legacy on-premises software. Portnox CLEAR NAC-as-a-service is cloud-native – “born in the cloud” as it were. To deploy CLEAR, a customer just needs to visit the sign-up page, enter their wireless controller information, configure the RADIUS settings on the network device, and CLEAR will begin enforcing policies. Portnox customers have done this in as fast as 30 minutes from start to finish. As is true of cloud-native solutions in other domains, customers can see value in minutes, not days, weeks, or even months. No complexity. No hassle.

Knowing the Difference Before You Commit

As a potential customer, how can you distinguish cloud-native from faux cloud security software? There are a few telltale signs. The table below summarizes some of the most salient differences. When you evaluate a new vendor, be sure to ask questions such as who is paying for the infrastructure? Who is responsible for updates and upgrades?