eBooks/eGuides

CHAPTER 1 What Is Ransomware? 7 The Ponemon Institute reports that the average cost of a data breach for targeted organizations is approximately $6.5 million. Cybercriminals typically sell stolen credit card and identity information on the dark web — anonymous web content (such as black market drug sales, child pornography, cybercrime, or other activities attempting to avoid surveillance or censorship) that requires special software, configuration, and/or authoriza- tion for access — for as little as a few cents to several dollars per record. The 2015 Cost of Cyber Crime Study by the Ponemon Insti- tute reported that the average selling price for stolen U.S. credit card data is approximately $0.25 to $60 per card. By comparison, a cybercriminal can make several hundred dollars to tens of thou- sands of dollars from ransoms directly paid to them by individual victims and organizations. The actual cost to victims of identity theft and credit card fraud was estimated in Javelin Strategy and Research's 2016 Identity Fraud Study to be $15 billion in 2015. The study also reveals that, although the number of U.S. victims of identity theft and credit card fraud has remained relatively steady since 2012, averaging approximately 12.8 million individual victims, fraud losses have declined by approximately 25 percent — meaning profits for cybercriminals, while still significant, are also declining. In contrast to the declining trend in identity theft and credit card fraud, the FBI reported a tenfold increase in ransomware crimes over the previous year during just the first three months of 2016. The cost to U.S. victim organizations and businesses is conserva- tively estimated to be more than $200 million, putting ransom- ware on pace to be a $1 billion crime in 2016. Understanding How Ransomware Operates Ransomware is commonly delivered through exploit kits, water- hole attacks (in which one or more websites that an organization frequently visits is infected with malware), malvertising (mali- cious advertising), or email phishing campaigns (see Figure 1-2). These materials are © 2017 John Wiley & Sons, Inc. Any dissemination, distribution, or unauthorized use is strictly prohibited.

• Cover
• Title Page
• Copyright Page
• Table of Contents
• Introduction
• About This Book
• Foolish Assumptions
• Icons Used in This Book
• Beyond the Book
• Chapter 1 What Is Ransomware?
• Defining Ransomware
• Recognizing Ransomware in the Modern Threat Landscape
• Understanding How Ransomware Operates
• Chapter 2 Implementing Best Practices to Reduce Ransomware Risks
• Before an Attack: Discover, Enforce, Harden
• During an Attack: Detect, Block, and Defend
• After an Attack: Scope, Contain, and Remediate
• Chapter 3 Building the "New Best-of-Breed" Security Architecture
• Recognizing the Limitations of Current Security Designs
• Defining the "New Best-of-Breed" Security Architecture
• Chapter 4 Deploying Cisco Ransomware Defense
• Leveraging DNS as the First Line of Defense in the Cloud
• Securing Endpoints and Addressing Email Threats
• Cisco Advanced Malware Protection (AMP) for Endpoints
• Cisco Email Security with Advanced Malware Protection (AMP)
• Protecting the Network with Next-Generation Firewalls and Segmentation
• Cisco Firepower Next-Generation Firewall (NGFW)
• Use the network as a sensor and enforcer
• Streamlining Deployments and Bolstering Incident Response
• Chapter 5 Ten Key Ransomware Defense Takeaways
• Ransomware Is Evolving
• Ransomware-as-a-Service Is an Emerging Threat
• Paying a Ransom Doesn't Solve Your Security Problems
• Build a Layered Security Architecture Based on Open Standards
• Deploy Integrated, Best-of-Breed Solutions
• Embed Security throughout Your Network Environment
• Reduce Complexity in Your Security Environment
• Leverage Cloud-Based, Real-Time Threat Intelligence
• Automate Security Actions to Reduce Response Time
• See Something, Say Something
• EULA