TIP 001
Trust
No
One
No
One
Implement a ZTNA 2.0 strategy everywhere.
What is the Ransomware Resilience?
The Ransomware Resilience, powered by Palo Alto Networks, is a community of cybersecurity professionals standing shoulder to shoulder to form a united front against the ever-growing threat of AI-powered cyberthreats.
By joining, you'll stay informed about upcoming virtual and in-person events happening in your area. Stay connected with the latest news, insights, and developments in the world of ransomware.
Take a stand today. Join the Ransomware Resilience and be a force for change.
Our top 10 tips
TIP 001
Trust
No
One
No
One
To try and get a handle on the exploding attack surface and regain control, Zero Trust Network Access has emerged as the preferred way to reduce the attack surface by providing the least-privileged direct-to-app access required by today's hybrid workforce. But there is an urgent need to replace legacy and outdated VPN deployments where existing ZTNA solutions fail to deliver on the promise of Zero Trust. A new approach is needed, and that new approach is ZTNA 2.0.
TIP 002
Narrow
the
field
the
field
Attack surface reduction with External Dynamic Lists, Layer 7 application policies with Policy Optimizer (App-ID), risky file reduction, and Cortex Xpanse.
TIP 002
Narrow
the
field
the
field
To reduce the attack surface, you must gain full visibility into traffic on your network, user behavior, and threats and across applications. It is likely that if you don't know what is happening on your network, an attacker does and will use that as a way to get in.
TIP 003
Remote
is not
alone
is not
alone
Isolate exposed RDP services with Layer 7 App-ID and Cortex Xpanse.
TIP 003
remote
is not
alone
is not
alone
Exposed RDP services continue to be among the largest initial access vectors for ransomware attackers. Microsoft RDP by default runs on port 3389, but it can run on any port, putting you at risk. Use Palo Alto Networks App-ID to get inside-out visibility and control for MS RDP, regardless of the port it's running on, and Cortex Xpanse for attack surface management (ASM) to discover if you have RDP exposed elsewhere in your organization.
TIP 004
Inspect
all
traffic
all
traffic
Implement SSL/TLS decryption for visibility and protection.
TIP 004
Inspect
all
traffic
all
traffic
The growth in encrypted (SSL/TLS) traffic traversing the internet is on an explosive upturn. Unfortunately, criminals have learned to leverage the lack of visibility and identification within encrypted traffic to hide from security surveillance and deliver ransomware. Organizations need to implement SSL/TLS decryption for visibility and protection.
TIP 005
prevent
the
unknown
the
unknown
Attackers continue to update their tactics to remain ahead of enterprise defenses, and use evasive techniques to avoid detection by traditional cybersecurity tools. While out-of-band and signature-based detection approaches remain critical in preventing known threats, protecting organizations from these attacks requires a new approach. As a result, machine learning and advanced analytics have become critical components of threat prevention tools.
TIP 006
Stay Ahead
of the
ADVERSARY
of the
ADVERSARY
Combat evasive Red Team tools, such as Cobalt Strike and others.
TIP 006
Stay Ahead
of the
ADVERSARY
of the
ADVERSARY
With the increasing use of tool sets like Cobalt Strike and encrypted or obfuscated traffic, it's easier for attackers to create completely customizable command-and-control channels. These channels cannot be stopped with traditional signature-based approaches.
TIP 007
Secure
Your
Blind spot
Your
Blind spot
Get visibility and protection for every IoT device (IoT/OT/IoMT).
TIP 007
Secure
Your
Blind spot
Your
Blind spot
Unseen vulnerable devices, access to business-critical systems and data based on implicit trust, limited threat protection, and operational complexity make it hard to defend enterprise networks from ransomware.
TIP 008
Guard
the
End zone
the
End zone
Traditional cybersecurity solutions struggled with the complexity of modern threats. XDR enables security teams to gain comprehensive visibility into potential threats and their broader context. This contextual understanding is crucial for accurately identifying sophisticated, multistage attacks that might otherwise go unnoticed, and significantly reducing the time between threat identification and mitigation.
TIP 009
Automate
The
Response
The
Response
Accelerate incident remediation with automated operations.
TIP 009
Automate
The
Response
The
Response
The more complex and malicious threats there are, the more companies need to develop efficient and effective approaches to the future of their security operations. Because of this need, SOAR is revolutionizing the way security operations teams manage, analyze, and respond to alerts and threats.
TIP 010
Secure
The
Web
The
Web
Phishing attacks are some of the most common security threats bombarding security teams today, leading to successful ransomware exploitation.
