This post is part of a blog series where we dissect the ten things to test in your future next-generation firewall. These ten points will help ensure your next firewall matches the needs of your organization in its current and future states.
A successful ransomware attack not only forces organizations to pay to regain access to the encrypted data but also incurs costs from lost opportunities or customers, equipment replacement, new security technologies, damaged reputations, and so on. To address the ransomware problem, most security vendors have updated their security architecture by tacking on ransomware prevention features to existing products.
Why Should You Advocate and Test This Capability?
No single security product can successfully prevent ransomware on its own. As there are multiple stages in the attack lifecycle, there should be multiple layers of defense to prevent ransomware attacks. Your organization’s ability to effectively protect against ransomware is reliant on the natively engineered automation and integration of your security products to proactively detect and prevent ransomware. A multilayered defense is the most effective way to disrupt possible ransomware attacks, and new additions to the security architecture should complement protections throughout the network.
Move Beyond the Status Quo
There Is No Silver Bullet
Protecting against ransomware requires visibility into network traffic and enforcement of applications, as well as user- and content-based policies. It also requires security products to protect against known and unknown exploits, malware, and command-and-control traffic, as well as prevent access to known malicious and phishing URLs.
Ransomware Is Time-Sensitive
Automation is the only way for prevention capabilities to move more quickly than a ransomware attack can transition through its full attack lifecycle within your organization. To identify and block unknown threats, malicious files and URLs must be detonated, analyzed and observed for malicious activity. Once a file or URL is identified as malicious, protections must be created and automatically distributed throughout the security infrastructure – across the network, cloud and endpoint. This ensures all points of entry are informed and capable of protecting against the latest version of the ransomware.
Combine Preventive Efforts
For effective prevention, you must employ automation and share information among various security tools that work together to identify known and unknown malware and exploits in your environment, and subsequently identify and quarantine any infected host, preventing the attack from spreading.
Threat intelligence should always be a component of your organization’s threat prevention efforts, and your firewall should be capable of dynamically updating preventions against malicious IPs, domains and URLs based on information gathered threat intelligence and IoCs.
Recommended RFP Questions
- Can your NGFW block executables and other risky file types from unknown applications and URLs to prevent ransomware attacks?
- Can your NGFW automatically and dynamically import all known IoCs (i.e., IPs, domains and URLs) into the blacklist to be proactive against all known ransomware families?
- Does the threat intelligence integration with the NGFW support dynamic updates for malicious URLs related to ransomware in the malware category of the URL filtering database?
- Does the threat intelligence cloud integration with the NGFW support dynamic updates for malicious domains related to ransomware as DNS signatures to be automatically blacklisted or sinkholed?
- Can your NGFW learn about threats or ransomware behavior from your endpoint protection software and vice versa?
Learn more about the 10 things to test for in your future NGFW.