Secure your infrastructure against VM ransomware

Prevention is key

Defense is a key strategy to implement against ransomware. Zero-trust adoption is one way IT teams keep up with the latest threats. The main tenets of zero-trust are the following:

1. Verify explicitly. Confirm that information sources include location, device compliance and multifactor user authentication.
2. Use least-privileged access. Every user must have limited access, which considers risk-based policies that provide minimal privileges to accomplish a specific task.
3. Assume breach. Use tools for intrusion detection and encryption to protect critical resources, and evaluate the potential effects of a compromise.

Bob Plankers, staff security and compliance architect at VMware, addressed the VMSA-2021-0010 vulnerability on the company blog.

"In this era of ransomware it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible," he wrote.

Comprehensive and regularly scheduled security patching is a key component of any security plan. Admins can also regularly verify and test functional backups and disconnected images.

Guidelines and frameworks

IT teams must plan how to respond to an attack before it happens. NIST special publication 800-61 provides a comprehensive summary of the steps required to build a computer security incident response capability.

The NIST document breaks down the incident response lifecycle into four areas:

• Preparation. Establish an incident response capability ahead of time and ensure infrastructure is secure.
• Detection and analysis. Use antivirus software, log analysis software and automated detection to identify and evaluate potential events.
• Containment, eradication and recovery. Isolate an event or virus so that incident response teams can develop a remediation strategy and reduce spread.
• Post-incident activity. Meet to address what happened and how to prevent such an incident in the future.

Section 3.2.1 makes an important point: "Incidents can occur in countless ways, so it is infeasible to develop step-by-step instructions for handling every incident." For this reason, organizations should focus on common attack vectors, such as external media, web-based and email attachments, and specific actions categorized as insider threats.

To address potential access points at the user level, NIST special publication 800-83 is titled "Guide to Malware Incident Prevention and Handling for Desktops and Laptops." IT teams that can stop attacks at the user level prevent further damage to the overall system and reduce the chance of a hacker getting privileged credentials.

Prepare for ransomware attacks

For many companies, the risks of ransomware extend to solvency or ruin. While virtualization can consolidate workloads that previously required multiple servers onto a single host, it has also made those host machines even higher-priority targets.

IT teams can follow the guidelines the NIST publications outline. Identify the most important assets, such as customer databases or accounting systems, and ensure there is an off-site backup. However, just having a backup in place isn't necessarily going to protect an organization from an attack.

Disaster recovery plans should include the potential for a major security breach and provide for continuity of operations if a ransomware attack occurs. Any recovery efforts should address what assets must be recovered, how and when they will be restored, and what part of the data is infected.

Organizations should have a list of individuals and companies to contact in case the worst happens. Most SMBs don't have the technical wherewithal to handle a serious security breach, so be sure to find a security or disaster recovery service provider that can.