LockBit Ransomware: How can you be better protected.

LockBit is one of the many ransomware strains that target computer systems accounting for almost 30% of attacks. LockBit is a ransomware-as-a-service (RaaS) group operates on a profit-sharing model, selling its services to cybercriminals, known as affiliates, who target organizations and deploy the ransomware. 80.5% percent of LockBit victims are small and medium-size businesses. Protecting your computer systems from ransomware like LockBit requires a multi-layered approach. The average costs to companies on reported successful ransomware attacks was in the region of $700k. However, the real cost can be much higher if you include reputational damage, regulatory fines, and legal costs. Here are some best practices to protect your computer systems from LockBit ransomware attacks:

1. Backup Regularly:

• Always have a backup of your important data. Ensure that backups are stored in a location that’s not connected to your main network, such as an external hard drive or a cloud service.
• Regularly test your backups to ensure they can be restored quickly in the event of an attack.

2. Keep Software Updated:

• Regularly update all software, including operating systems, applications, and antivirus programs. Cybercriminals often exploit known vulnerabilities in outdated software.

3. Use Antivirus and Anti-ransomware Software:

• Invest in a reputable antivirus solution that includes anti-ransomware protection. Ensure it’s always updated with the latest definitions.

4. Educate Employees:

• Train employees to recognize phishing emails and malicious attachments. Most ransomware attacks start with a simple phishing email, so generally employees are the weakest link.
• Carry out phishing simulations on your staff on a regular basis and have follow up training. Keep repeating.

5. Limit User Privileges:

• Not every user on your network needs admin rights. Limiting user privileges can prevent ransomware from gaining the system-level access it often needs to encrypt files.
• In addition, admin privileges should be controlled, logged and time limited.

6. Implement Network Segmentation:

• Divide your network into segments to prevent ransomware from spreading across the entire infrastructure.

7. Use Email Filtering:

• Implement email filtering solutions that can detect and block phishing emails and malicious attachments.

8. Restrict Remote Desktop Protocol (RDP):

• If not needed, disable RDP on all machines. If RDP is necessary, use strong passwords, two-factor authentication, and ensure it’s not accessible from the open internet.

9. Regularly Patch and Update Systems:

• Ensure that all systems are patched regularly. Cybercriminals often exploit vulnerabilities in unpatched systems.

10. Implement Application Whitelisting:

• Only allow approved applications to run on your network. This can prevent unauthorized applications, including ransomware, from executing.

11. Use Multi-Factor Authentication (MFA):

• Implement MFA wherever possible, especially for critical systems and data access.

12. Stay Informed:

• Stay updated on the latest ransomware threats and protection measures. Join cybersecurity forums, subscribe to threat intelligence feeds, and regularly consult with cybersecurity experts.

13. Incident Response Plan:

• Have a well-defined incident response plan in place. Knowing what to do immediately after detecting a ransomware attack can limit damage and speed up recovery.

Remember, while these measures can significantly reduce the risk of a ransomware attack, no system can be made entirely invulnerable. The key is to layer defences, stay informed, backup your data, train your staff, and be prepared to respond quickly in the event of an attack. Speak to one of our cybersecurity experts at Archway Securities to find out more.