Hello Friends. As you all are aware about the recent ransomware attack, and in case if someone is unaware, Here are some points that really needs to be taken care of.
Ransomware 2.0
Origin
2. Update your operating systems as well as antivirus or any other security solutions.
3. Do not allow users to install new applications to be run as Administrator in the computer systems.
4. Remove internet connection and take backup of your crucial data on a removable hard drive (hard disk or USB flash drive).
5. Do not open any link in malicious emails from unknown users.
6. Implement group policy to disable macros.
7. Recheck network shares with write permissions etc.
8. And Most Important Thing - Explore more options to prevent this attack.
Stay safe!!
Ransomware 2.0
First of all, lets's try to understand what ransomware is all about. Ransomware is basically a computer malware that encrypts and locks user's files and computer system. It then asks for a payment of some amount to unlock your computer and decrypt your files. The amount it demands is in form of bitcoins and within a specific amount of time given.
WannaCry
WannaCry (or WanaCrypt or WCry or Wanna decryptor) is a ransomware that is spreading all over the world and targetting Windows machines (mainly) in a very fast manner. The first infections were reported against hospitals in UK on Friday, 12th May 2017.
Origin
WannaCry is a flaw in Microsoft Server Message Block (SMB) service. This service allows user to share their files and printers in a local area network (LAN). Microsoft released a patch (MS17-010) for this service earlier this year in march.
What to do?
So, what should we do to prevent our system from affecting by this ransomware? Here are few steps that you may try to stop this malware from attacking your system.
1. Do not allow SMB port and RDP to access all the computers from the internet. To do this, block port 445 and 139 for SMB (TCP and UDP) and block port 3389 for RDP (Remote Desktop Protocol).
2. Update your operating systems as well as antivirus or any other security solutions.
3. Do not allow users to install new applications to be run as Administrator in the computer systems.
4. Remove internet connection and take backup of your crucial data on a removable hard drive (hard disk or USB flash drive).
5. Do not open any link in malicious emails from unknown users.
6. Implement group policy to disable macros.
7. Recheck network shares with write permissions etc.
8. And Most Important Thing - Explore more options to prevent this attack.
Stay safe!!
No comments:
Post a Comment