Colonial Pipeline: Ransomware Is Not Slowing Down

Colonial Pipeline: Ransomware Is Not Slowing Down

Date: May 17, 2021
Tags: ,

Colonial Pipeline Company — one of the nation’s largest pipeline operators, supplying fuel across a 5,500-mile distance from Texas to New York — was recently attacked by ransomware. The ransomware attack forced Colonial Pipeline to shut down its systems and pause all operations. This attack will go down in history as one of the largest cyberattacks on U.S. critical infrastructure that has impacted millions of consumers and businesses.

The Federal Bureau of Investigation (FBI) has since confirmed that DarkSide was responsible for this ransomware incident. DarkSide is a criminal actor (as opposed to a nation-state actor) whose sole purpose is to profit from organizing ransomware attacks and share the proceeds with other ransomware developers.

According to the FBI’s Internet Crime Report, the Internet Crime Complaint Center received 2,474 complaints that were classified as ransomware in 2020 alone, accounting for a loss of $29.1 million, more than triple the amount in 2019. Ransomware is a growing problem.

Additionally, the increase in remote work caused by COVID-19 can also be attributed to the increase in ransomware attacks in 2020. Ransomware attacks have debilitating effects on information technology (IT) and operational technology (OT) across industries, especially those that support the nation’s critical infrastructure. So, what exactly is a ransomware attack? According to the Cybersecurity & Infrastructure Security Agency (CISA),

“Ransomware is an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.”

What can you do to prevent ransomware? CISA, in collaboration with the Multi-State Information Sharing and Analysis Center (MS-ISAC), has developed a Ransomware Guide (September 2020) to include prevention and response tips and best practices. Some prevention best practices include:

  • Maintain offline and encrypted backups of your data and be sure to regularly test these backups
  • Develop a cyber incident response plan and associated communications plan
  • Conduct regular vulnerability scanning, patch and software updates
  • Ensure all devices are properly configured and security features are enabled
  • Implement best practices for use of Remote Desktop services
  • Disable or block Server Message Block (SMB) protocol outbound and remove or disable outdated versions

“As critical OT industries, such as  energy and renewables, continue to digitally transform, they can mitigate damages by implementing a cyber resiliency approach that leverages zero-trust architectures throughout the OT supply chain, restricting the attacker’s ability to move latterly in all environments,” says Jyoti Wadhwa, T-Rex’s lead Cybersecurity Solutions Architect.

In addition to the above best practices, learn more about preventing various types of cyber-attacks. Read our blog post on Modern Cybersecurity: Modern Resilience.


recently posted
The Path to Zero Trust Maturity

The Path to Zero Trust Maturity

As the world continues to battle the pandemic, a remote workforce persists. Given the sudden and continued need for remote capabilities, organizations are forced to assess and consider strengthening their security measures to meet an entirely new set of demands […]

DataOps: Toward an Incremental Data Process

DataOps: Toward an Incremental Data Process

Data science projects are known to have a high failure rate of up to 85% despite the nature of their important role to business. Integrating data analytics into core Information Technology (IT) capabilities can be elusive and daunting. “If we […]

FinOps: Modernizing Cost Planning and Management in Hybrid IT Environments

FinOps: Modernizing Cost Planning and Management in Hybrid IT Environments

According to the latest forecast from Gartner, Inc Worldwide, end-user spending on public cloud services is forecast to grow 23.1% in 2021 to total $332.3 billion, up from $270 billion in 2020. While cloud spending is increasing at a rapid […]

What is Zero Trust and Why Do I Need It?

What is Zero Trust and Why Do I Need It?

The traditional approach to cybersecurity, known as perimeter and defense in depth models, are not enough. Bad actors continue to evolve their methods of attack to access an organization’s most mission critical systems. How can your business withstand a cyber-attack?