Improving The Security of Your Organization via Mock Malware Incidents

No ratings

Presented at NYMJCSC 2016 by

Christopher Frenz

An all too common headline is becoming “business held for ransom” as organizations begin to see a spike in ransomware attacks being conducted against them. While there are numerous checklists in existence, such as the OWASP Anti-Ransomware Guide (https://www.owasp.org/images/a/a8/Anti-RansomwareGuide.pdf), that can provide guidance to organizations on the types of security controls they can put in place to prevent and mitigate malware attacks, these guides do nothing to help organizations ensure that the controls they selected are implemented both properly and effectively. Moreover, such guides do little to ensure that the people designated to respond to a malware incident do so in an optimal way. Organizations should never assume a control is effectively implemented without taking the time to see if there are ways in which a control can be circumvented or, worse yet, actually verifying that the control is even actually in place. In order to vet the controls that organizations have implemented and the responses of their employees, organizations should turn towards red team exercises, such as conducting mock malware incidents. This presentation will walk participants through several mock malware incidents used to test and improve the security of a Brooklyn-based medical center and will describe the types of lessons that can be learned from conducting such incidents.