*/
The risks of ransomware have been well publicised in the last few years, but cyber security analysts around the world have recently seen it evolve into a more industrialised form called Ransomware-as-a-Service (RaaS). Some observers have described it as a new criminal business model and even a whole new cybercriminal economy. So what is RaaS and what can be done to defend against it?
Ransomware groups are understood to use two methods of operation, either direct attack or RaaS. The latter has increased the risks for organisations trying to defend themselves because now a greater number of adversaries potentially has access to the tools they need to infiltrate IT networks. Even relatively low-skilled groups or individuals can get their hands on malicious software (malware) and direct it at whichever organisations they wish.
RaaS can be broken down into three components:
Each group pays fees for any services they buy from other groups and/or splits the money they make from the organisations they attack. The model spreads the workload, the risks involved and any financial rewards. There’s no new sophisticated technology here, it’s simply a different way that threat actors are working together as they amend their tactics, techniques and procedures (TTPs).
RaaS is a much more industrialised set-up that some analysts have even described as a new cybercriminal business model. Now that criminal groups specialise in a single area rather than attempt to manage all the stages themselves, they can invest their energy and time into mastering one specific act of the crime.
This also means that less skilled groups and those without much experience can simply purchase ready-made tools from other groups and apply them to their chosen targets. Whereas ransomware used to be opportunistic, RaaS has enabled gangs to target firms more precisely.
The nature of the RaaS model also makes it more difficult to identify the unique signatures that cybercriminals leave behind for digital forensics teams to find. The hallmarks found following a RaaS cyber-attack will be blurred by up to three different sets of ‘fingerprints’ at the crime scene instead of the one set that would have previously provided evidence of a single group.
RaaS is still fairly new and, as with almost everything in cyber security, it’s continually evolving, so we’re bound to see new developments unfold in the coming months and years. Time will tell whether RaaS will eventually prove to be the dominant modus operandi for all cybercriminal groups or if it will only be a temporary trend that will fail to be effective for the longer term for as yet unknown reasons.
RaaS really shouldn’t be anything more to worry about than usual. At its heart, cyber security isn’t a technology problem. It’s a risk management problem, and one that involves people using technology, building partnerships and communicating to resolve the problem together.
The fundamental risk management practices that can be applied to cyber security will help to minimise the chances of a RaaS cyber-attack: good cyber hygiene, cyber security awareness training, offensive security, or penetration testing, and a strong Security Operations Centre (SOC) and the capability to protect the whole IT ecosystem.
Criminals always want to take the easiest route to make money, so it’s worth the effort to make it as difficult as possible for them, and to ensure that the new cybercrime economy does not pay.
Feel free to contact us at info@quorumcyber.com if you have any questions or concerns about ransomware, or want to find out more about how we can help you reduce your risks. You can read about how we’re already helping the legal sector at https://www.quorumcyber.com.
The risks of ransomware have been well publicised in the last few years, but cyber security analysts around the world have recently seen it evolve into a more industrialised form called Ransomware-as-a-Service (RaaS). Some observers have described it as a new criminal business model and even a whole new cybercriminal economy. So what is RaaS and what can be done to defend against it?
Ransomware groups are understood to use two methods of operation, either direct attack or RaaS. The latter has increased the risks for organisations trying to defend themselves because now a greater number of adversaries potentially has access to the tools they need to infiltrate IT networks. Even relatively low-skilled groups or individuals can get their hands on malicious software (malware) and direct it at whichever organisations they wish.
RaaS can be broken down into three components:
Each group pays fees for any services they buy from other groups and/or splits the money they make from the organisations they attack. The model spreads the workload, the risks involved and any financial rewards. There’s no new sophisticated technology here, it’s simply a different way that threat actors are working together as they amend their tactics, techniques and procedures (TTPs).
RaaS is a much more industrialised set-up that some analysts have even described as a new cybercriminal business model. Now that criminal groups specialise in a single area rather than attempt to manage all the stages themselves, they can invest their energy and time into mastering one specific act of the crime.
This also means that less skilled groups and those without much experience can simply purchase ready-made tools from other groups and apply them to their chosen targets. Whereas ransomware used to be opportunistic, RaaS has enabled gangs to target firms more precisely.
The nature of the RaaS model also makes it more difficult to identify the unique signatures that cybercriminals leave behind for digital forensics teams to find. The hallmarks found following a RaaS cyber-attack will be blurred by up to three different sets of ‘fingerprints’ at the crime scene instead of the one set that would have previously provided evidence of a single group.
RaaS is still fairly new and, as with almost everything in cyber security, it’s continually evolving, so we’re bound to see new developments unfold in the coming months and years. Time will tell whether RaaS will eventually prove to be the dominant modus operandi for all cybercriminal groups or if it will only be a temporary trend that will fail to be effective for the longer term for as yet unknown reasons.
RaaS really shouldn’t be anything more to worry about than usual. At its heart, cyber security isn’t a technology problem. It’s a risk management problem, and one that involves people using technology, building partnerships and communicating to resolve the problem together.
The fundamental risk management practices that can be applied to cyber security will help to minimise the chances of a RaaS cyber-attack: good cyber hygiene, cyber security awareness training, offensive security, or penetration testing, and a strong Security Operations Centre (SOC) and the capability to protect the whole IT ecosystem.
Criminals always want to take the easiest route to make money, so it’s worth the effort to make it as difficult as possible for them, and to ensure that the new cybercrime economy does not pay.
Feel free to contact us at info@quorumcyber.com if you have any questions or concerns about ransomware, or want to find out more about how we can help you reduce your risks. You can read about how we’re already helping the legal sector at https://www.quorumcyber.com.
Sam Townend KC explains the Bar Council’s efforts towards ensuring a bright future for the profession
Giovanni D’Avola explores the issue of over-citation of unreported cases and the ‘added value’ elements of a law report
Louise Crush explores the key points and opportunities for tax efficiency
Westgate Wealth Management Ltd is a Partner Practice of FTSE 100 company St. James’s Place – one of the top UK Wealth Management firms. We offer a holistic service of distinct quality, integrity, and excellence with the aim to build a professional and valuable relationship with our clients, helping to provide them with security now, prosperity in the future and the highest standard of service in all of our dealings.
Is now the time to review your financial position, having reached a career milestone? asks Louise Crush
If you were to host a dinner party with 10 guests, and you asked them to explain what financial planning is and how it differs to financial advice, you’d receive 10 different answers. The variety of answers highlights the ongoing need to clarify and promote the value of financial planning.
Most of us like to think we would risk our career in order to meet our ethical obligations, so why have so many lawyers failed to hold the line? asks Flora Page
If your current practice environment is bringing you down, seek a new one. However daunting the change, it will be worth it, says Anon Barrister
Creating advocacy opportunities for juniors is now the expectation but not always easy to put into effect. Tom Mitcheson KC distils developing best practice from the Patents Court initiative already bearing fruit
National courts are now running the bulk of the world’s war crimes cases and corporate prosecutions are part of this growing trend, reports Chris Stephen
Let’s hear it for the assessors, says Dame Anne Rafferty of the KC Selection Panel. And to make silk assessors’ lives a little easier when applicants come calling in May, Dame Anne fields some commonly asked questions
