1

First of all I'm aware that I should use some anti-virus mechanism to prevent as much as possible any ransomware being delivered through my mail server - and yes I'm already using that kind of protection.

What is the best practice for a sys admin to fight against ransomwares? I had in my mind couple of things, like; blocking mostly used (by them) file types, implementing SPF, DKIM and DMRAC, anti-spam mechanism... So any ideas guys?

This can be useful to know because I belive that ransomwares are most of the time delivered through emails. EDIT: my belive was right, here is an example of 2016 stats - Email is the #1 delivery vehicle for ransomware -

enter image description here

Source

  • 2
    Not exactly the best answer but really a very strict regimen of training your users very well. Make sure that you've created an environment where they feel comfortable asking some tech if an attachment is probably legit or not. People are generally the weakest link. Other than that, setup a GPO to whitelist software that can be executed. Lockdown macros in office and secure Acrobat. – Sirens Aug 13 '17 at 2:39
5

To add to Julia's answer, this might sound a little bit cliche, but education is another strong point of defending against malware. Awareness of phishing links, even sending a global email to everyone with basics steps on how to be careful against emails does wonders. Surprising as it may sound, a lot of people don't even know that emails can contain scam or other far worse malicious intrusions. This is from social side.

3

You can use an network intrusion detection system ((N)IDS) like SNORT or Suricata (SNORT is my choice). This can be configured to sniff all email & check for signatures against a database of known threats. You can also make sure that on the host machine you have some anti-malware such as malwarebyte labs anti-malware. The NIDS is a stronger solution in my opinion, as it can scan all incoming and outgoing traffic for any kind of threat.

2

There are multiple things you can do:

  • install an anti-virus on the server, it can help

  • use RBLs (international block lists to deny many spam sources)

  • use your own access list (and block addresses, IPs and domains that spam you)

  • add a specialized e-mail server firewall-like system to your server (a specialized security appliance)

1

Perhaps consider a third party service as a spam filter so email is delivered and filtered there before even hitting your email server.

  • Isn't a spam filter a generic defense? The question seems to ask for a ransomware-specific defense. Or a set of defenses (OP asked for "best practice") to fight against ransomares? – Sas3 Aug 14 '17 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.