Co-authored by Sarju Pandey.

Ransomware attacks are on the rise, and organisations are struggling to find a way to stop them.

Attack simulations have long been used by military organisations as a defensive tactic, but they can also be used in cyber security to help prevent security breaches.

What is ransomware?

Ransomware is a type of malicious software (malware) developed to encrypt files on an infected computer and holds the key to decrypt the files until the victim pays a ransom (usually in the form of Bitcoin) to malicious actors.

All organisations are exposed to ransomware attacks regardless of their size which cause severe damage to the organisation’s reputation.

Attackers specifically target organisations with sensitive data such as government agencies because these organisations need access to those files to operate on a daily basis.

The attackers operate on the assumption the organisation will be willing to pay the ransom rather than lose the files or have the files leaked to the public.

Prominent recent ransomware examples are Locky, SamSam, and WannaCry, the latter infected up to 300,000 victims in 150 countries.

Here are some frightening statistics:

• Over 50% of all businesses were hit by ransomware in 2020
• The average ransom demand was over $178,000, including the average ransom for a small business of around $5,900
• In 2019, cybercriminals reaped over $11.5 billion in ransom payments
• The estimated damage from ransomware attacks increased from an estimated $1 billion in 2016 to $20 billion in 2020
• The average total cost of an organisation to recover from a ransomware attack has been doubled in 2021
• The average ransom paid is now standing at $170,404, according to Sophos’ annual state of ransomware report.

What is an Attack Simulation?

Attack simulations are designed to test the strength of an organisation’s security mechanisms by launching a simulated attack on its infrastructure.

These types of tests help organisations identify, understand, and implement better technical defences against attacks with minimal disruption in their daily activities.

Attackers can exploit vulnerabilities that don’t have any protection yet or lack detection mechanisms.

The simulations are conducted in a controlled environment with the help of cyber security consultants and can measure key performance indicators (KPIs) such as:

• Time to detect an attack.
• How long it takes for various systems to recover from attacks.
• Which parts of the infrastructure were affected by particular types of malicious software.

Penetration tests and red team engagements begin with understanding the current state of security (is it up-to-date, are there any known vulnerabilities that were not patched yet) and identifying potential weaknesses in the organisation’s cyber defences.

It can be followed by a white box type assessment where consultants have access to information about how the systems work (systems and network diagrams).

The penetration test simulates an attack on the organisation’s systems with the goal of identifying what could happen if a real cyber-attack were to take place, closely observing KPIs such as the time it takes for intrusion detection or incident response teams to notice an attack.

An attack simulation can simulate exploitation of endpoints, data exfiltration, and lateral movement through a network, targeting the most valuable assets.

When live testing isn’t feasible, attack simulations can be conducted by performing tabletop exercises with key stakeholders to explore attack scenarios and identify any gaps in the response.

In addition, attack simulation allows the security team to take the initiative and actively measure security controls, rather than hoping current security measures are good enough to prevent a successful attack.

Attack Simulations are an excellent tool for security assessments. They contain valuable information about the organisation’s risk level and provide clear recommendations on how to improve its infrastructure, thus preventing cyber-attacks in the future.

Ransomware prevention

The techniques used in an attack simulation are based on standard practices cyber criminals use to breach a network and execute a ransomware attack. This gives security teams the opportunity to become battle-hardened and prepare for real attacks.

Attack simulations can be a very useful – it allows security teams to run through multiple attack scenarios with limited visibility into the network and closely monitor KPIs, such as how quickly they notice an attack and what happens when they disconnect the simulated infection from the network.

An attack simulation can be used to test (but not limited to):

• Whether various types of security measures like endpoint protection and data leak prevention (DLP) tools work effectively in preventing ransomware attacks
• If users are able to recognise phishing emails and avoid opening any suspicious attachments
• Whether corporate backups will successfully restore files in the event of a ransomware attack
• Whether incident response procedures can effectively contain and shut down malware infections
• How well systems recover from an attack.

The results obtained after running an attack simulation give organisations better insight into what they should focus on to improve their security posture and preparedness.

This can then be used to inform how much time and effort can be spent on security.

Attack simulations provide organisations with an accurate picture of their security posture.

They allow security teams to discover vulnerabilities in their cyber defences and showcase the most effective methods for building a more resilient infrastructure against various types of malware attacks.

Ransomware is not going away anytime soon – if anything, it’s here to stay.

Attack simulations can be a useful tool for examining ransomware mitigation plans and identifying possible weak points in the organisation’s defences.

This is a highly valuable exercise, as they allow security teams to simulate real threats against their infrastructure and identify weaknesses before it’s too late.