12-16-2019, 11:45 PM
Facing ransomware demands, one company had an unusual response
<div style="margin: 5px 5% 10px 5%;"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/12/facing-ransomware-demands-one-company-had-an-unusual-response.jpg" width="1024" height="683" title="" alt="" /></div><div><p>“What would you get from paying a ransom in such an attack?” Gimnes Are asks. “You will potentially get back your encrypted data – if the attacker gives you the key. Paying the ransom would not help you to rebuild the company infrastructure, all the servers, all the PCs, all the networks.</p>
<p>“Paying the ransom will not help you out of the situation. You will need to rebuild your infrastructure to be safe and be sure that the attacker is not still part of it,” he adds.</p>
<p>At Microsoft, Eric Doerr serves as general manager of the <a href="https://www.microsoft.com/en-us/msrc" target="_blank" rel="noopener noreferrer">Microsoft Security Response Center</a>, which protects customers from being harmed by security vulnerabilities in Microsoft’s products and services. The center also rapidly repulses attacks against the Microsoft Cloud. Doerr strongly promotes transparency among organizations that suffer cyberattacks.</p>
<p>“Norsk Hydro set the example for the industry in this incident,” Doerr says.</p>
<p>“Choosing not to pay the ransom and digging in with DART to evict the attacker is great. Sharing those learnings with the world is priceless. When companies do this, it makes us all better and makes the attackers work harder,” he adds.</p>
<p>Of course, some companies facing a ransomware attack may be highly tempted to pay bad actors to regain their hijacked data. But paying hackers doesn’t guarantee that a company will ever recover the goods, says Ann Johnson, Microsoft’s corporate vice president of cybersecurity solutions.</p>
<p>There’s a smarter way – following the plan executed by Norsk Hydro, says Johnson, whose team oversees DART.</p>
<p>“Your data is a strategic asset for you, and for cybercriminals. That’s why they want it. It is also why your data must be protected, and it should be backed up,” Johnson says.</p>
<p>At the same time, companies must invest in cybersecurity, she adds.</p>
<p>At Norsk Hydro, for example, the IT department works to increase security awareness among its employees, says Molland, the media relations SVP. That includes sending workers test emails to help train them to look for <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/phishing" target="_blank" rel="noopener noreferrer">common phishing tactics</a> like fake login pages and malicious attachments.</p>
<p>If companies fail to commit to cybersecurity, Johnson warns, bad actors will become repeat customers.</p>
<p>“You’ve likely seen signs that read, ‘Don’t feed the birds,’ when dining at an outdoor café. That’s because the birds will keep returning to the same places where they know it’s easy to be fed. It’s the same concept for cybercriminals,” Johnson says. “They know if you have weak cyber-defenses, and they will want to exploit those weaknesses over-and-over.</p>
<p>“The best defense is to ensure you have the right combination of people, processes and technology. We recommend you implement multifactor authentication, have a mature update process, and back up your data,” she adds.</p>
<p><figure id="attachment_29990" aria-describedby="caption-attachment-29990" class="wp-caption alignnone"><img class="wp-image-29990 size-large" src="https://www.sickgaming.net/blog/wp-content/uploads/2019/12/facing-ransomware-demands-one-company-had-an-unusual-response.jpg" alt="Two Norsk Hydro workers work their way through the cyberattack using paper data. " width="1024" height="683"><figcaption id="caption-attachment-29990" class="wp-caption-text">At a Norsk Hydro extrusion plant in Norway, sales project manager Rune Johansen and extrusion anodizing fabrication manager Sten Stolpe dig through paper documentation to manually complete customer orders during the cyberattack.</figcaption></figure>
</p>
<p>In Hungary and Norway last March, DART members helped Norsk Hydro develop safe processes to restore their servers with an improved security posture. They also educated the company about the current threat landscape and known attacker behaviors to help reduce the risk of future attacks, Moeller says.</p>
<p>Inside Norsk Hydro, the internal response focused on multiple fronts. They launched old-school methods to resume full production and repair business operations. And they worked to protect the safety of employees and the environment.</p>
<p>“We operate heavy machinery. If the power is lost in an uncontrolled manner, it could risk severe safety incidents for people,” says Molland, the media relations SVP.</p>
<p>“Safety is always first priority with us. Secondly, it’s the concern for the environment and ensuring we don’t have any uncontrolled emissions (due to sudden machine stoppages) out to the air, land or water.”</p>
<p>Executives handwrote signs warning of the cyberattack, photographed them with their smart phones and texted the images to managers at Norsk Hydro plants and offices around the world. At those facilities, the staff used local printing shops to create paper signs, posting them on entryways, stairwells and elevators for employees to read as they arrived for the workday.</p>
<p>“Please do not connect any devices to the Hydro network. Do not turn on any devices connected to the Hydro network. Please disconnect devices from the Hydro network,” read some written alerts that also carried a simple signature: “Security.”</p>
<p><figure id="attachment_29989" aria-describedby="caption-attachment-29989" class="wp-caption alignnone"><img class="wp-image-29989 size-large" src="https://www.sickgaming.net/blog/wp-content/uploads/2019/12/facing-ransomware-demands-one-company-had-an-unusual-response-1.jpg" alt="Two Norsk Hydro workers use pen and paper to restore production amid the cyberattack. " width="1024" height="768"><figcaption id="caption-attachment-29989" class="wp-caption-text">Two workers at a Norsk Hydro plant in Portland, Oregon manually operate machines to produce specific customer orders during the initial phase of the cyberattack.</figcaption></figure>
</p>
<p>The entire workforce did their jobs with pen and paper during the attack’s first days. Some plants switched to manual procedures to meet manufacturing orders. Retired employees – familiar with the old paper system – volunteered to return to their plants to keep production rolling.</p>
<p>“The way we pulled together to make the company come through the situation in one piece and get back into production has been an extreme team-building session,” Molland says.</p>
<p>“We have an organized emergency preparedness methodology within the company – in the corporate level, in the business area and at the plant level,” he adds. “That worked to our benefit. When this hit us, we were able to handle the situation in a constructive, organized manner.”</p>
<p>In other words, prevention is important but locking out all cyberattackers should not be a company’s sole security focus, says Jo De Vliegher, Norsk Hydro’s chief information officer.</p>
<p>“If hackers want to get in, they will get in,” De Vliegher says. “We now have an improved incident response to make sure that – should something similar happen – we are much better equipped to limit the damage in time and geography.”</p>
<p>Norsk Hydro reported the incident to Norway’s National Criminal Investigation Service (Kripos). The case remains under investigation, Molland says.</p>
<p><em>Video and photos courtesy of Norsk Hydro. </em></p>
</div>
https://www.sickgaming.net/blog/2019/12/...-response/
<div style="margin: 5px 5% 10px 5%;"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2019/12/facing-ransomware-demands-one-company-had-an-unusual-response.jpg" width="1024" height="683" title="" alt="" /></div><div><p>“What would you get from paying a ransom in such an attack?” Gimnes Are asks. “You will potentially get back your encrypted data – if the attacker gives you the key. Paying the ransom would not help you to rebuild the company infrastructure, all the servers, all the PCs, all the networks.</p>
<p>“Paying the ransom will not help you out of the situation. You will need to rebuild your infrastructure to be safe and be sure that the attacker is not still part of it,” he adds.</p>
<p>At Microsoft, Eric Doerr serves as general manager of the <a href="https://www.microsoft.com/en-us/msrc" target="_blank" rel="noopener noreferrer">Microsoft Security Response Center</a>, which protects customers from being harmed by security vulnerabilities in Microsoft’s products and services. The center also rapidly repulses attacks against the Microsoft Cloud. Doerr strongly promotes transparency among organizations that suffer cyberattacks.</p>
<p>“Norsk Hydro set the example for the industry in this incident,” Doerr says.</p>
<p>“Choosing not to pay the ransom and digging in with DART to evict the attacker is great. Sharing those learnings with the world is priceless. When companies do this, it makes us all better and makes the attackers work harder,” he adds.</p>
<p>Of course, some companies facing a ransomware attack may be highly tempted to pay bad actors to regain their hijacked data. But paying hackers doesn’t guarantee that a company will ever recover the goods, says Ann Johnson, Microsoft’s corporate vice president of cybersecurity solutions.</p>
<p>There’s a smarter way – following the plan executed by Norsk Hydro, says Johnson, whose team oversees DART.</p>
<p>“Your data is a strategic asset for you, and for cybercriminals. That’s why they want it. It is also why your data must be protected, and it should be backed up,” Johnson says.</p>
<p>At the same time, companies must invest in cybersecurity, she adds.</p>
<p>At Norsk Hydro, for example, the IT department works to increase security awareness among its employees, says Molland, the media relations SVP. That includes sending workers test emails to help train them to look for <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/phishing" target="_blank" rel="noopener noreferrer">common phishing tactics</a> like fake login pages and malicious attachments.</p>
<p>If companies fail to commit to cybersecurity, Johnson warns, bad actors will become repeat customers.</p>
<p>“You’ve likely seen signs that read, ‘Don’t feed the birds,’ when dining at an outdoor café. That’s because the birds will keep returning to the same places where they know it’s easy to be fed. It’s the same concept for cybercriminals,” Johnson says. “They know if you have weak cyber-defenses, and they will want to exploit those weaknesses over-and-over.</p>
<p>“The best defense is to ensure you have the right combination of people, processes and technology. We recommend you implement multifactor authentication, have a mature update process, and back up your data,” she adds.</p>
<p><figure id="attachment_29990" aria-describedby="caption-attachment-29990" class="wp-caption alignnone"><img class="wp-image-29990 size-large" src="https://www.sickgaming.net/blog/wp-content/uploads/2019/12/facing-ransomware-demands-one-company-had-an-unusual-response.jpg" alt="Two Norsk Hydro workers work their way through the cyberattack using paper data. " width="1024" height="683"><figcaption id="caption-attachment-29990" class="wp-caption-text">At a Norsk Hydro extrusion plant in Norway, sales project manager Rune Johansen and extrusion anodizing fabrication manager Sten Stolpe dig through paper documentation to manually complete customer orders during the cyberattack.</figcaption></figure>
</p>
<p>In Hungary and Norway last March, DART members helped Norsk Hydro develop safe processes to restore their servers with an improved security posture. They also educated the company about the current threat landscape and known attacker behaviors to help reduce the risk of future attacks, Moeller says.</p>
<p>Inside Norsk Hydro, the internal response focused on multiple fronts. They launched old-school methods to resume full production and repair business operations. And they worked to protect the safety of employees and the environment.</p>
<p>“We operate heavy machinery. If the power is lost in an uncontrolled manner, it could risk severe safety incidents for people,” says Molland, the media relations SVP.</p>
<p>“Safety is always first priority with us. Secondly, it’s the concern for the environment and ensuring we don’t have any uncontrolled emissions (due to sudden machine stoppages) out to the air, land or water.”</p>
<p>Executives handwrote signs warning of the cyberattack, photographed them with their smart phones and texted the images to managers at Norsk Hydro plants and offices around the world. At those facilities, the staff used local printing shops to create paper signs, posting them on entryways, stairwells and elevators for employees to read as they arrived for the workday.</p>
<p>“Please do not connect any devices to the Hydro network. Do not turn on any devices connected to the Hydro network. Please disconnect devices from the Hydro network,” read some written alerts that also carried a simple signature: “Security.”</p>
<p><figure id="attachment_29989" aria-describedby="caption-attachment-29989" class="wp-caption alignnone"><img class="wp-image-29989 size-large" src="https://www.sickgaming.net/blog/wp-content/uploads/2019/12/facing-ransomware-demands-one-company-had-an-unusual-response-1.jpg" alt="Two Norsk Hydro workers use pen and paper to restore production amid the cyberattack. " width="1024" height="768"><figcaption id="caption-attachment-29989" class="wp-caption-text">Two workers at a Norsk Hydro plant in Portland, Oregon manually operate machines to produce specific customer orders during the initial phase of the cyberattack.</figcaption></figure>
</p>
<p>The entire workforce did their jobs with pen and paper during the attack’s first days. Some plants switched to manual procedures to meet manufacturing orders. Retired employees – familiar with the old paper system – volunteered to return to their plants to keep production rolling.</p>
<p>“The way we pulled together to make the company come through the situation in one piece and get back into production has been an extreme team-building session,” Molland says.</p>
<p>“We have an organized emergency preparedness methodology within the company – in the corporate level, in the business area and at the plant level,” he adds. “That worked to our benefit. When this hit us, we were able to handle the situation in a constructive, organized manner.”</p>
<p>In other words, prevention is important but locking out all cyberattackers should not be a company’s sole security focus, says Jo De Vliegher, Norsk Hydro’s chief information officer.</p>
<p>“If hackers want to get in, they will get in,” De Vliegher says. “We now have an improved incident response to make sure that – should something similar happen – we are much better equipped to limit the damage in time and geography.”</p>
<p>Norsk Hydro reported the incident to Norway’s National Criminal Investigation Service (Kripos). The case remains under investigation, Molland says.</p>
<p><em>Video and photos courtesy of Norsk Hydro. </em></p>
</div>
https://www.sickgaming.net/blog/2019/12/...-response/