Ransomware: Best Practices for Critical Infrastructure Companies

This month, the Colonial Pipeline paid a $4.4 million ransom to malicious cyber actors who hacked their information technology network to steal data. Would you have done the same?

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) report that these criminals deployed DarkSide ransomware against the pipeline company’s network. The incident has motivated almost every business, especially critical infrastructure businesses, to adopt a heightened state of awareness about ransomware. CISA and the FBI have issued a list of recommendations for CI companies. These mitigations are intended to help CI owners and operators “improve their entity’s functional resilience by reducing their vulnerability to ransomware and the risk of severe business degradation if impacted by ransomware.” The following is from a CISA Alert (AA21-131A), “DarkSide Ransomware: Best Practices for Preventing Business Disruption From Ransomware Attacks.”

CISA and FBI urge CI owners and operators to apply the following mitigations to reduce the risk of compromise by ransomware attacks:

• Require multi-factor authentication for remote access to OT and IT networks.
• Enable strong spam filters to prevent phishing emails from reaching end users. Filter emails containing executable files from reaching end users.
• Implement a user training program and simulated attacks for spearphishing to discourage users from visiting malicious websites or opening malicious attachments and reinforce the appropriate user responses to spearphishing emails.
• Filter network traffic to prohibit ingress and egress communications with known malicious IP addresses. Prevent users from accessing malicious websites by implementing URL blocklists or allowlists.
• Update software, including operating systems, applications, and firmware on IT network assets, promptly. Consider using a centralized patch management system; use a risk-based assessment strategy to determine which OT network assets and zones should participate in the patch management program.
• Limit access to resources over networks, especially by restricting RDP. After assessing risks, if RDP is deemed operationally necessary, determine the originating sources and require multi-factor authentication.
• Set antivirus/antimalware programs to scan IT network assets regularly using up-to-date signatures. Use a risk-based asset inventory strategy to determine how OT network assets are identified and evaluated for the presence of malware.
• Implement unauthorized execution prevention by:
  • Disabling macro scripts from Microsoft Office files transmitted via email. Use Office Viewer software to open Microsoft Office files sent via email instead of complete Microsoft Office suite applications.
  • Implementing applications allows listing, allowing systems to execute programs known and permitted by security policy. Implement software restriction policies (SRPs) or other controls to prevent programs from running from common ransomware locations, such as temporary folders supporting popular Internet browsers or compression/decompression programs, including the AppData/LocalAppData folder.
  • Monitor and block inbound connections from Tor exit nodes and other anonymization services to IP addresses and ports for which external connections are not expected (i.e., other than VPN gateways, mail ports, and web ports). For more guidance, refer to Joint Cybersecurity Advisory AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor.
  • Deploy signatures to detect or block inbound connections from Cobalt Strike servers and other post-exploitation tools.

CISA and FBI urge CI owners and operators to apply the following mitigations now to reduce the risk of severe business or functional degradation should their CI entity fall victim to a ransomware attack in the future.

• Implement and ensure robust network segmentation between IT and OT networks to limit the ability of adversaries to pivot to the OT network even if the IT network is compromised. Define a demilitarized zone that eliminates unregulated communication between the IT and OT networks.
• Organize OT assets into logical zones by considering criticality, consequence, and operational necessity. Define acceptable communication conduits between the zones and deploy security controls to filter network traffic and monitor communications between zones. Prohibit industrial control system (ICS) protocols from traversing the IT network.
• Identify OT and IT network inter-dependencies and develop workarounds or manual controls to ensure ICS networks can be isolated if the connections create a risk to the safe and reliable operation of OT processes. Regularly test contingency plans such as manual controls so that safety-critical functions can be maintained during a cyber incident. Ensure that the OT network can operate at the necessary capacity even if the IT network is compromised.
• Regularly test manual controls so that critical functions can be kept running if ICS or OT networks need to be taken offline.
• Implement regular data backup procedures on both the IT and OT networks. Backup procedures should be conducted on a frequent, regular basis. The data backup procedures should also address the following best practices:
  • Ensure that backups are regularly tested.
  • Store your backups separately. Backups should be isolated from network connections that could enable the spread of ransomware. Backups must be maintained offline as many ransomware variants attempt to find and encrypt or delete accessible backups. Maintaining backups offline is critical because if your network data is encrypted with ransomware, your organization can restore systems to their previous state. The best practice is to store your backups on a separate device that cannot be accessed from a network, such as on an external hard drive. (See the Software Engineering Institute’s page on ransomware).
  • Maintain regularly updated “gold images” of critical systems if they need to be rebuilt. This entails maintaining image “templates” that include a preconfigured operating system (OS) and associated software applications that can be quickly deployed to rebuild a system, such as a virtual machine or server.
  • Retain backup hardware to rebuild systems if the primary system is not preferred. Hardware newer or older than the primary system can present installation or compatibility hurdles when reconstructing from images.
  • Store source code or executables. It is more efficient to rebuild from system images. However, some images will not install on different hardware or platforms correctly; having separate access to needed software will help.
• Ensure user and process accounts are limited through account use policies, user account control, and privileged account management. Organize access rights based on the principles of least privilege and separation of duties.

If your organization is impacted by a ransomware incident, CISA and FBI recommend the following actions:

• Isolate the infected system. Remove the infected system from all networks, and disable the computer’s wireless, Bluetooth, and other potential networking capabilities. Ensure all shared and networked drives are disconnected, whether wired or wireless.
• Turn off other computers and devices. Power off and segregate (i.e., remove from the network) the infected computer(s). Power off and segregate any other computers or devices that share a network with the infected computer(s) that have not been fully encrypted by ransomware. If possible, collect and secure all infected and potentially infected computers and devices in a central location, making sure to label any computers that have been encrypted clearly. Powering off and segregating infected computers and computers that have not been fully encrypted may allow for the recovery of partially encrypted files by specialists. (See Before You Connect a New Computer to the Internet for tips on how to make a computer more secure before you reconnect it to a network.)
• Secure your backups. Ensure that your backup data is offline and secure. If possible, scan your backup data with an antivirus program to check that it is malware-free.
• Refer to Joint Cybersecurity Advisory: AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity for more best practices on incident response.

Note: CISA and the FBI do not encourage paying a ransom to criminal actors. Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and fund illicit activities. Paying the ransom also does not guarantee that a victim’s files will be recovered. CISA and FBI urge you to report ransomware incidents to your local FBI field office.

CISA offers no-cost cyber hygiene services to help CI organizations assess, identify, and reduce their exposure to threats, including ransomware. By requesting these services, organizations of any size could find ways to reduce their risk and mitigate attack vectors.

Resources

• CISA and MS-ISAC: Joint Ransomware Guide
• CISA: Ransomware page
• CISA Tip: Protecting Against Ransomware
• CISA: CISA Ransomware One-Pager and Technical Document
• CISA Insights: Ransomware Outbreak
• CISA: Pipeline Cybersecurity Initiative
• CISA Webinar: Combating Ransomware
• CISA: Cybersecurity Practices for Industrial Control Systems
• FBI: Incidents of Ransomware on the Rise
• National Security Agency (NSA): Stop Malicious Cyber Activity Against Connected Operational Technology
• Department of Energy: Oil and Natural Gas Subsector Cybersecurity Capability Maturity Model
• Transportation Security Agency: Pipeline Security Guidelines
• National Institute of Standards and Technology (NIST): Framework for Improving Critical Infrastructure Cybersecurity
• NIST: Ransomware Protection and Response
• NIST: Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events
• NIST: Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events
• NIST: Data Integrity: Recovering from Ransomware and Other Destructive Events
• NIST: Guide to Industrial Control Systems (ICS) Security
• Software Engineering Institute: Ransomware: Best Practices for Prevention and Response
• NIST Fact Sheet: How Do I Stay Prepared?