Ransomware – The Looming Threat
Application Whitelisting for cyber security. Throughout the last 18 months, rarely did a day go by a company, school, government agency, or public municipality went without a ransomware infection. Since January, twelve educational institutions publicly announced being hit with ransomware, with ransom payments ranging from $28,000 to $2,900.
The success behind ransomware lies in the ability to alter the malware’s variant to avoid detection from most security solutions. Most security programs use a blacklist to monitor malware threats. If a program or file is not on the blacklist, it is deemed unknown. The blacklist allows these unknown files to execute. The flaw lies within this methodology. Hackers are able to create new ransomware variants every few seconds, if they so choose. The blacklist antivirus is unaware that a new variant is now running on the system.
When a ransomware variant morphs, it changes its coding. Meaning, the malicious code identified on the blacklist is no longer used. Therefore, the new, unknown, variant is allowed to execute on endpoints using traditional security solutions that implement the blacklist as their primary method of malware detection. The blacklist has become, and will always be, one step behind.
Yet, if the security industry knows the weakness, what is it doing to fix it?
An advanced security method that completely blocks ransomware and malware from running on a system is available. It is application whitelisting.
Application Whitelisting – Why It’s Effective
As cyber security threats continue to advance, so should endpoint security. The devices and machines that access the network can compromise the entire system if a hacker’s malware penetrates the blacklist antivirus security software. Whitelisting blocks any new or unknown program files from executing. Many malware payloads piggyback onto legitimate programs or use macros to trick users into downloading a virus or trojan. With a global whitelist of good programs, these malicious programs simply can not run.
Whitelisting helps prevent the spread of malware viruses on the network. Once on a machine, malware can execute and spread allowing unauthorized access to cybercriminals intent on stealing data and ransoming critical systems. The application whitelisting only allows trusted programs to execute. Ransomware can spread in seconds and only a proactive layer of security can prevent the spread across the network.
Therefore, instead of allowing unknown files to run like the blacklist antivirus software, the whitelist will prevent unknown files from executing until tested and proven safe. Whitelisting technology is far more effective in preventing ransomware attacks, including polymorphic variants.
Ransomware Can Morph in Seconds
For example, back in 2016 the ransomware variant, Cerber was morphing its code every 15 seconds to avoid detection. However with application whitelisting, regardless of how many times the coding changes, the variants will always be considered unknown. Therefore, since the variants are not on the application whitelist, they will not run.
Often times ransomware campaigns spread through phishing emails, which include a malicious link or attachment. The Vice President of Cyber Security for PC Matic states,
“All it takes is one employee to download a malicious attachment from an email to infect your entire network. Use Application whitelisting software to stop malware from executing in the event an employee accidentally downloads malware.”
Beyond blocking ransomware threats,
“Application whitelisting software can also help prevent the spread of viruses and worms from infecting computers across the entire organization, and causing damage to the company’s finances, productivity and reputation.”
According to the most recent Virus Bulletin Reactive and Proactive (RAP) test results the application whitelist technology, which tests under the company name PC Matic, proactively prevents 99.97% of malware threats. Compare this to the proactive average of all security solutions in the test, 64.35%, one has to question why they aren’t implementing this technology sooner. Waiting for a device to have a virus before the solution activates is being reactive. With ransomware attacks organizations need to be proactive and prevent infection in the first place.
Application Whitelisting Best Practices
What are application whitelisting best practices and how do IT professionals implement them? Best practices ensure zero-trust access to whitelist applications and tools. Only admins who need to have access to remote desktop tools, server and cloud resources can have permission to do so. Whitelists only include legitimate, safe programs and scripts with valid publisher digital signatures. Learn more about Application Whitelisting Best Practices.
PC Matic security software solutions protect computers, laptops and business networks from malware infection and ransomware attacks. Learn more about PC Matic Pro designed to protect business IT systems using Application Whitelisting for Business.
