Data Theft

The cybercriminal gains access to your IT system by exploiting a security vulnerability, phishing successfully for login credentials, or purchasing access on the dark web. As discussed in Insider-caused data breaches, an employee with authorised access may give access maliciously or inadvertently.  

Once in your system the cybercriminals usually search for valuable data within your networks, and may make use of other vulnerabilities to enable them to get past internal security and move freely around your system undetected.   

The cybercriminal prepares the data they want to steal, often using tools to compress or encrypt the data. Staging is often detected as part of the investigation. 

The cybercriminal makes use of legitimate software tools such as MEGASync or Google Drive to move the staged data from your network to theirs. They sometimes set up a site with a countdown timer as part of their cyber extortion demand, which would result in the data being released on to the dark web if their ransom is not paid. If cybercriminals do not receive a response, they may reach out to employees and clients directly. 

Phishing is one of the main ways that cybercriminals steal passwords or get employees to download malicious software inadvertently on to your IT network.

REDUCE EXPOSURE TO PHISHING EMAILS

Implement measures that could change the way suspicious emails are handled (SPF, DKIM, DMARC are email security standards that can help to mitigate spam and phishing attacks). Consider blocking email from new domains, which may have been set up by cybercriminals for phishing.

Patch on-premise email servers to deprive cybercriminals of any low-hanging fruit.

INTELLIGENT EMAIL EVALUATION

Automatically detonate and evaluate inbound attachments and links in a sandbox environment to determine if malicious prior to user delivery.

Damage from data theft can be reduced if your data is encrypted. 

Cybercriminals will use tools, such as MEGASync, to steal data or use remote monitoring and management (RMM) tools to maintain a hidden presence on your networks. To help prevent this from happening, ‘whitelist’ the software tools your team uses and block others to deprive access to cybercriminals.

Train your employees to recognise phishing emails and teach them about the risks of clicking on links or opening attachments.    

When effectively deployed and monitored, end-point detection and response (EDR) tools are one of the best defences against ransomware and other malware attacks. 

EDR solutions monitor servers, laptops, desktops and managed mobile devices for signs of malicious or unusual user behaviour/activity. These tools also enable rapid response by trained security experts. It is important that your EDR solutions are in enforcement mode rather than audit mode. 

Many organisations benefit from external help to identify weaknesses in firewalls or switches that can lead to lateral movement through your systems, and  gain a better  understanding of how cybercriminals can  leverage this access. 

Preserve firewall logs, which roll over quickly. If you have centralised logs, protect them and keep a copy and ensure that they are not deleted.