A warning to our clients and those concerned with the latest cybersecurity threats.  The FBI has issued an Extortion email PSA stating that there has been an exponential jump in the number of extortion threats sent via email to businesses of all sizes.  The threat involves the launching of DDoS attacks against a victim’s website unless or until a ransom is paid.

This type of attack has been around for years, however they have recently grown in size, impact, and duration.  DDoS (Distributed Denial of Service) attacks attempt to flood the bandwidth of a victim’s servers and overload connections so that legitimate traffic cannot get through.

From a recent article on this very type of attack:

“ In the early 2000s, DDoS attacks reached a speed of approximately 4 gigabit/sec. Now, they average between 10 and 60 Gbps per second – or even faster. A DDoS incident this past February peaked at almost 400 Gbps. And the average DDoS attack now lasts 17 hours.”

Attacks that have taken out access to Foutune 100 websites for hours are now being targeted at businesses of all sizes, many of which do not have the resources to stop (or in some cases recover from) an attack of this nature.  However, there are proactive steps that can be taken which will minimize the attack’s impact if not stop it entirely.

 

Mitigation Steps:

• Have a third party review your current policies and procedures for defending against DDoS attacks. If you don’t have a policy for employees or third-party vendors, it is strongly recommended that you create and have one in place before experiencing this type of attack.
• Distribute services among various locations rather than having one centralized data center. In the event of an attack, services can be switched to servers that are not being targeted.
• Ensure that your company’s DDoS response policy clearly lists the managed service partner who can respond to and remediate the issue in order to maintain business continuity
• Contact your local FBI field office and file a complaint with the IC3 at IC3.gov. Be sure to provide any relevant information in your complaint including the entire extortion email.
• Be proactive rather than reactive. Layer 8 Security can help prepare your company for this type of attack.  Don’t wait until the fire to purchase the fire extinguisher; stay ahead of the enemy.
• Now is also a great time to review your Cyber Hygiene training for your employees, to mitigate against phishing, which can lead to malware, spyware, keyloggers and more being put onto the company’s network. Training is the key to ensuring your people are not the cause of a breach within your company.

BACK TO BLOGS