HiPhi Security Manual (EN)

Bitdefender Technical Solution Brief Ransomware Prevention and Mitigation with Bitdefender GravityZone Contents Ransomware Overview..........................................................................................................................................................

3 What is Ransomware?...........................................................................................................................................................................3 How does Ransomware Penetrate the Organization?........................................................................................................................3 What does Ransomware Protection Entail?........................................................................................................................

4 Protected Ransomware Attack Vectors...............................................................................................................................................5 How Bitdefender Ransomware Mitigation Works...............................................................................................................................5 Tamperproof Backups......................................................................................................................................................................................5 Blocking and Prevention...................................................................................................................................................................................5 Monitoring and Early Detection......................................................................................................................................................................5 EDR and Incident Response............................................................................................................................................................................6 User and System Risk Mitigation...................................................................................................................................................................6 Why You Need Bitdefender Ransomware Mitigation..........................................................................................................................6 Bitdefender Ransomware MitigationUse Cases..................................................................................................................

7 Remote Ransomware Mitigation..........................................................................................................................................................7 Local Ransomware Mitigation..............................................................................................................................................................7 Incident Management from GravityZone.............................................................................................................................................7 The GravityZone Difference..................................................................................................................................................

8 GravityZone’s Unmatched Combination of Ransomware Defenses......................................................................................................8 The Most Awarded Endpoint Security Vendor .................................................................................................................... 9 See Bitdefender GravityZone in Action................................................................................................................................................9 Get Protected against Ransomware....................................................................................................................................

9 Contact Us for More Information and a Demo....................................................................................................................................9 2

Стр. 2

Bitdefender Technical Solution Brief Ransomware Prevention and Mitigation with Bitdefender GravityZone Ransomware Overview What is Ransomware? Ransomware is malicious software that seeks to encrypt files and hold them for ransom. Ransomware victims must pay the attackers to regain access to resources, typically in untraceable cryptocurrency, in return for a decryption key which may or may not arrive after payment is made.

For an individual, files like pictures, videos or important documents can cause anxiety if compromised, but for a business entity the ransomed content could easily include proprietary information, customer personal information, account and payment card details, or other valuable data. Ransomware is nearly always motivated by profit, however advanced ransomware attacks can have wider objectives and cause tremendous harm to organizations, including existential concerns should the ransomware attack cause the entity to be unable to continue in its normal course of business. In extreme cases, human lives can even be put at risk.

Examples of recent high-profile ransomware attacks with outsized monetary losses and negative social impact: Hospitals: British National Health Service (est. total costs of Ј92 million in direct costs and lost productivity) State/Local Government: State of Louisiana (state of emergency declared), 2 Florida cities ($1.1 million paid) Education: University of Utah ($457,000 paid), University of California San Francisco ($1.14 million paid) Ransomware can manifest on an infected laptop, desktop or server in multiple ways, typically denying user access to the system until the ransom is paid:

• Encrypts sensitive and personal files with no possibility of decryption • Threatens the public release of sensitive and personal files • Locks the computer’s screen denies complete access to the system • Blocks certain applications from running, crippling user productivity Ransomware is highly adaptable, carefully designed to avoid detection by security software. Even small delays in detection can provide enough time for potentially irreversible file encryption to take place. How does Ransomware Penetrate the Organization? Ransomware has many viable paths into the organization and cybercriminals are very creative in their exploitation of both technological and human vulnerabilities.

Despite years of security awareness training, risky user behavior persists at stubbornly high rates, leading to risky clicks on dubious links and ill-considered application/file downloads. Targeted phishing email laden with malicious links and file attachments Malicious document downloads, either user-initiated or triggered via drive-by downloads Malicious application/executable file downloads, including bogus software and fake product updates Fileless attacks in memory space initiated from the browser, without ever touching the disk drive Infected documents and media files from network file shares and portable media drives Figure 1: Common ransomware attack vectors 3

Стр. 3

Bitdefender Technical Solution Brief Ransomware Prevention and Mitigation with Bitdefender GravityZone What does Ransomware Protection Entail? Comprehensive ransomware mitigation requires proactive vigilance on multiple simultaneous fronts, each of which must be covered by the security solution.

Preemptive Protection – Create tamperproof backup copies of user files that are inaccessible to ransomware Monitoring & Early Detection – Watch suspicious processes and network activity, correlate attack indicators Blocking and Prevention – Deploy adaptive defenses not reliant on signature-based detection techniques EDR and Incident Response – No prevention is 100% effective all the time, so EDR looks for suspicious indicators on the endpoint and in the network traffic to correlate into specific incidents for response Vulnerability Patching – Update vulnerable applications and operating systems with the newest vendor-supplied patched, applied automatically Risky Configuration Management – Identify and close all readily available sources of ingress for ransomware by identifying and correcting system misconfigurations, many of which can be remediated automatically User Behavior Risk Monitoring – …Identify and correct user behaviors that increase risk to the organization like password reuse, falling for phishing lures, risky clicks and downloads, and logins to unencrypted websites Application and Device Control – Monitor usage and allow only the required applications to run and only the necessary external devices to access the system.

Beating ransomware requires understanding the full cyber kill-chain and mapping defenses to each attack stage. Recon Execution Discovery Privilege Escalation Access Token Manipulation Exploits Impact Lateral Movement Initial Access Defense Evasion Disable protection Baypass UAC Stored Data Manipulation Employers’ email addresses Account Discovery Domain Trust Discovery Network Share Discovery Network Service Scanning Ransomware Credential Access Credential Dumping Persistence Services Schedule Tasks Run Keys Spearphishing Link Remote Services RDP Figure 2: Ransomware attack tactics and the typical cyber kill-chain 4

Стр. 4

Bitdefender Technical Solution Brief Ransomware Prevention and Mitigation with Bitdefender GravityZone Protected Ransomware Attack Vectors Relief from ransomware all of its devastating effects also requires coverage of all common attack vectors:

Phishing or spam email links and malicious file attachments Malicious file downloads, both user-initiated and caused by drive-by downloads Malicious application or executable file downloads Fileless attacks in memory space initiated from the browser without ever touching the disk Portable media drives and network or remote file shares How Bitdefender Ransomware Mitigation Works Tamperproof Backups Bitdefender creates automatic, up-to-date tamperproof backup copies of user files, without using shadow copies that have been repeatedly proven to be easily deleted by ransomware. It’s hands-free protection, with nothing for the user to do.

Ransomware can’t access the protected backup files and the user is unaware of their presence. Ransomware Mitigation identifies whenever a possible new ransomware attempts to encrypt files and automatically creates a backup of targeted files that will be restored after the malware is blocked. Bitdefender blocks all processes involved in the attack and starts remediation, while also notifying the user. Blocking and Prevention Fileless Attack Defense and Hyper Detect When activated, Bitdefender automatically discovers and blocks fileless attacks at the pre-execution stage, preventing file encryption and preserving full system access.

HyperDetect can detect and block fileless attacks at pre-execution using highly tuned machine learning models to spot new and unknown malware with high accuracy to successfully defeat fileless ransomware during multiple stages of the attack kill chain by analyzing the behavior at code level. Machine Learning Anti-Malware Bitdefender security automatically and continuously trains and improves its malware recognition capabilities using one of the industry’s largest sample repositories, collected in the wild from a vast network of global sensors. As ransomware continues to evolve, Bitdefender accurately detects new patterns in pre-execution and at runtime.

Advanced Anti-Exploit Ransomware authors use exploit kits that take advantage of zero-day or unpatched vulnerabilities to gain a system foothold. Bitdefender focuses on attack techniques to protect systems and prevent ransomware from spreading. Advanced anti-exploit technologies can quickly identify and terminate malicious processes automatically. Network Protection Network Attack Defense uses behavioral heuristics to analyze host network activity in real-time and harden controls against exploit techniques that can exfiltrate personal information from your network. It uses machine learning to block ransomware exploits that arrive via network ingress points such as BlueKeep.

Network Protection also serves to halt malicious activity in the initial access, credential access, discovery and lateral movement attack stages. Monitoring and Early Detection Advanced Threat Control GravityZone monitors running processes in real time—registry key modifications, file reads/writes, encryption action—to identify suspicious or malicious processes for automatic or manual termination by security teams. 5

Стр. 5