Colonial Pipeline: Ransomware Is Not Slowing Down

Colonial Pipeline: Ransomware Is Not Slowing Down

Date: May 17, 2021
Tags: ,

Colonial Pipeline Company — one of the nation’s largest pipeline operators, supplying fuel across a 5,500-mile distance from Texas to New York — was recently attacked by ransomware. The ransomware attack forced Colonial Pipeline to shut down its systems and pause all operations. This attack will go down in history as one of the largest cyberattacks on U.S. critical infrastructure that has impacted millions of consumers and businesses.

The Federal Bureau of Investigation (FBI) has since confirmed that DarkSide was responsible for this ransomware incident. DarkSide is a criminal actor (as opposed to a nation-state actor) whose sole purpose is to profit from organizing ransomware attacks and share the proceeds with other ransomware developers.

According to the FBI’s Internet Crime Report, the Internet Crime Complaint Center received 2,474 complaints that were classified as ransomware in 2020 alone, accounting for a loss of $29.1 million, more than triple the amount in 2019. Ransomware is a growing problem.

Additionally, the increase in remote work caused by COVID-19 can also be attributed to the increase in ransomware attacks in 2020. Ransomware attacks have debilitating effects on information technology (IT) and operational technology (OT) across industries, especially those that support the nation’s critical infrastructure. So, what exactly is a ransomware attack? According to the Cybersecurity & Infrastructure Security Agency (CISA),

“Ransomware is an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.”

What can you do to prevent ransomware? CISA, in collaboration with the Multi-State Information Sharing and Analysis Center (MS-ISAC), has developed a Ransomware Guide (September 2020) to include prevention and response tips and best practices. Some prevention best practices include:

  • Maintain offline and encrypted backups of your data and be sure to regularly test these backups
  • Develop a cyber incident response plan and associated communications plan
  • Conduct regular vulnerability scanning, patch and software updates
  • Ensure all devices are properly configured and security features are enabled
  • Implement best practices for use of Remote Desktop services
  • Disable or block Server Message Block (SMB) protocol outbound and remove or disable outdated versions

“As critical OT industries, such as  energy and renewables, continue to digitally transform, they can mitigate damages by implementing a cyber resiliency approach that leverages zero-trust architectures throughout the OT supply chain, restricting the attacker’s ability to move latterly in all environments,” says Jyoti Wadhwa, T-Rex’s lead Cybersecurity Solutions Architect.

In addition to the above best practices, learn more about preventing various types of cyber-attacks. Read our blog post on Modern Cybersecurity: Modern Resilience.


recently posted
What is Zero Trust and Why Do I Need It?

What is Zero Trust and Why Do I Need It?

The traditional approach to cybersecurity focuses on building  walls to keep out bad actors. This was known as the perimeter and defense in depth models, which worked in the early days of the Internet, but are no longer sufficient for […]

How to modernize to the cloud: A Census Case History

How to modernize to the cloud: A Census Case History

The 2020 Census went online for the first time ever without a single second of downtime and zero hacks. T-Rex helped contribute to this success as the Technical Integrator. T-Rex’s Chief Technology & Innovation Officer Jason Keplinger and Chief Engineer […]

Modern Cybersecurity: Modern Resilience

Modern Cybersecurity: Modern Resilience

Cyber resiliency is the ability to maintain mission assurance despite being faced with adversity via cyber threats. It is critical to incorporate it at all levels of your organization, from mission or business function level to organizational level, sector level […]

What We Can Learn from the SolarWinds Breach

What We Can Learn from the SolarWinds Breach

The SolarWinds breach in December 2020 demonstrates the importance of having a fortified cybersecurity approach to protect data. SolarWinds, a US-based software company, was hacked late last year. This breach remained undetected until early 2021. The supply chain attack introduced […]