TriniTuner.com | Latest Event:
Moderator: 3ne2nr Mods
elec2020 wrote:redmanjp wrote:elec2020 wrote:If financial companies always looking for new ways to cut costs you think they willing to dash out the huge chunks of money needed for a secure IT system with qualified individuals? Doubt it. They probably was using the bare minimum standards using contracted (not in house) IT experts for more serious matters. It was always a matter of time till these big hacking groups realice that the Caribbean financial companies there for the taking.
if we had data protection laws where they can get sued for tens or hundreds of millions like in the US then im sure they would rather shell out the money to secure their systems and hire professionals.
very true but which government going and put in a law that can cost the 1 per cent, sorry their financiers millions of dollars? NONE
Hwells wrote:' In all civil suits its all about what damages the plaintiff occurred because of the defense."
So the damages that 'may occur' as a result of my information being open in the public or the breaking of trust confidence and confidentiality has no say or recourse for compensation?
redmanjp wrote:if the hackers publish the info, can they now be sued?
Increase in ransomware attacks targeting public and private entities in Trinidad and Tobago
The Trinidad and Tobago Cyber Security Incident Response Team (TT-CSIRT) has observed a significant increase in ransomware attacks targeting local organizations. Ransomware is a type of malware that prevents users from accessing their system or files and demands a ransom payment in order to regain access. Threat actors have also threaten to publish or sell the victim’s sensitive data if they refuse to pay however paying the ransom does not guarantee that an organization will regain access to their data.
TT-CSIRT is urging all entities (public and private) to adopt a heighten state of awareness and be guided by the following:
Attack Vectors
Ransomware attacks can be initiated through multiple attack vectors. The most prominent ones that TT-CSIRT has seen used against local entities are:
Exploiting system vulnerabilities (particularly outdated firewall devices and exposed remote desktop protocol)
Phishing emails with infected attachments or links
Compromising user credentials
When ransomware is deployed and installed by the threat actors, it will then seek to encrypt documents and files within the computer and other connected systems on the network. Once the ransomware has completed file encryption, it creates and displays a ransom note containing instructions on how the victim can pay the ransom. Again, payment of the ransom does not guarantee that an organization will regain access to their data.
Countermeasures
Keep systems and applications up-to-date; especially firewall appliances and anti-virus software
Perform regular backups. Store these backups offline (i.e. on a device that cannot be accessed from the network)
Enable strong spam filtering and scan all incoming and outgoing emails to detect threats and filter executable files from reaching end users
Authenticate inbound emails (with SPF, DMARC and DKIM) to prevent email spoofing.
Conduct security awareness training with employees
Implement network segmentation and data categorization to minimize exposure of mission-critical and sensitive data
Restrict users’ permissions to install and run software applications, and apply the principle of “least privilege” to all systems and services. Restricting these privileges may prevent malware from running or limit its capability to spread through a network.
Use the “application allow” feature to allow only approved applications/programs to run on a network
Securing system administrations tools that attackers could abuse
Disabling third-party or outdated components that could be used as entry points
Disable the loading of macros in your Office programs
Disable Remote Desktop whenever possible and never expose it directly to the internet
Implement multi-factor authentication wherever possible
Block web sites that are known for being malware breeding grounds (illegal download sites, porn sites, etc.)
Develop an incident response plan and a business continuity plan in the event that a ransomware attack takes place
If you become infected, isolate the affected system(s) immediately by removing the infected system from all networks, and disable all potential networking capabilities. Ensure all shared and networked drives are disconnected whether wired or wireless. Infected systems will have to be analyzed by your security team or your security provider to determine whether the encrypted data is recoverable.
Should your institution fall victim to a ransomware attack or any other type of cyber-attack, please contact TT-CSIRT immediately for assistance.
redmanjp wrote:i'd be worried if this threat was wormable- i.e. spreads automatically through a network WITHOUT user interaction, because then u can infect hundreds of machines, including servers!
anyone know the name of the ransomware?
redmanjp wrote:i'd be worried if this threat was wormable- i.e. spreads automatically through a network WITHOUT user interaction, because then u can infect hundreds of machines, including servers!
anyone know the name of the ransomware?
elec2020 wrote:I seeing some company names and some individuals. Those entities/individuals could sue Ansa Mcal for breach in service. That or Ansa Mcal will try to settle the matter privately/below the table
pugboy wrote:that’s exactly what they do
once’s drives accessible on networkredmanjp wrote:i'd be worried if this threat was wormable- i.e. spreads automatically through a network WITHOUT user interaction, because then u can infect hundreds of machines, including servers!
anyone know the name of the ransomware?
pugboy wrote:at least weekly backups should be done and stored physically detached from the network
redmanjp wrote:pugboy wrote:at least weekly backups should be done and stored physically detached from the network
that's one of the problems we have is not nearly enough space for it even on a server and afaik no offline storage devices
pugboy wrote:install a next server to hold the backups
and have it physically detached after each backup or something like thatredmanjp wrote:pugboy wrote:at least weekly backups should be done and stored physically detached from the network
that's one of the problems we have is not nearly enough space for it even on a server and afaik no offline storage devices
