1

We have a MS Windows Server 2012 installed. After the attacks of last week, I was wondering how we could improve the security of the server against ransomware/cryptoware.

We did install the latest updates from Microsoft.

What else can we do?

marked as duplicate by Serge Ballesta, Xander, schroeder May 18 '17 at 6:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    This is too broad a question. We have no way to know to what you are vulnerable to, so we can't answer this. Are you talking about ransomware protection ? Otherwise, you should first identify what are your risks and vulnerabilities and find solution to minimise your risks. – M'vy May 17 '17 at 7:47
  • Yes I am talking about ransomware protection. Sorry if my question is too broad I'll edit it. I hope this will make it more clear as of what I'm asking – Ludisposed May 17 '17 at 7:52
8

The basics for protection against ransomware is :

  • Update frequently (OS, AntiVirus, ...)
  • Don't open phishing / infected emails which usually convey the ransomware (user awareness)
  • Backup, backup, backup (and check them!)

The majority of the ransomware risk is cancelled by a proper backup strategy. If your data are safe in some offline place, they can crypt whatever they want. It's surely a hindrance to go through the restore procedure, but it does not cost more.

Some basic techniques might also help, email filters, macros scanning/disabling, using a least privilege policy for your user.

  • Thank you for your answer. New to this section, so excuse my noobiness. We do Update frequently; we have backups at multiple locations; we also have a strict mail/browser policy. So we are reasonable safe? – Ludisposed May 17 '17 at 8:11
  • 3
    I cannot reasonably tell you "you're ok". Security depends a lot on context. If you want to have a 'level' of 'safeness' you really should do a proper risk analysis. – M'vy May 17 '17 at 8:15
  • What do you mean by frequently? In some of clients that I worked, they also mention "updates frequently" and it was quarterly. Quarterly updates wouldn't cover you in this case of WCry ransomware. You need a proper patch management process, with tight SLAs for critical patches (max 1 week to remediate critical patches). – Ricardo Reimao May 17 '17 at 9:56
  • 1
    Frequently = as often you need so that the impact of a successful attack is lower than what you can accept as loss. This is basic risk management. You define a level of risk acceptance, you asses the risks and compute their level of risk, then you put on measure to lower the risk under the level of acceptance. Again, there is no 'absolute' thruth here. It all depends on your context. – M'vy May 17 '17 at 10:04
  • 2
    @Philipp my fav from a decade ago: a full backup programme with daily, weekly, monthly, yearly tape rotations. Top of the line tape backup systems. Every new IT employee first trained on backups. Backups were the top priority before anything else. Disaster struck and they needed to recover: found out that the tapes all had their "write protection" tab turned on. All tapes were blank... – schroeder May 17 '17 at 10:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.