Colonial Pipeline: Ransomware Is Not Slowing Down

Colonial Pipeline: Ransomware Is Not Slowing Down

Date: May 17, 2021
Tags: ,

Colonial Pipeline Company — one of the nation’s largest pipeline operators, supplying fuel across a 5,500-mile distance from Texas to New York — was recently attacked by ransomware. The ransomware attack forced Colonial Pipeline to shut down its systems and pause all operations. This attack will go down in history as one of the largest cyberattacks on U.S. critical infrastructure that has impacted millions of consumers and businesses.

The Federal Bureau of Investigation (FBI) has since confirmed that DarkSide was responsible for this ransomware incident. DarkSide is a criminal actor (as opposed to a nation-state actor) whose sole purpose is to profit from organizing ransomware attacks and share the proceeds with other ransomware developers.

According to the FBI’s Internet Crime Report, the Internet Crime Complaint Center received 2,474 complaints that were classified as ransomware in 2020 alone, accounting for a loss of $29.1 million, more than triple the amount in 2019. Ransomware is a growing problem.

Additionally, the increase in remote work caused by COVID-19 can also be attributed to the increase in ransomware attacks in 2020. Ransomware attacks have debilitating effects on information technology (IT) and operational technology (OT) across industries, especially those that support the nation’s critical infrastructure. So, what exactly is a ransomware attack? According to the Cybersecurity & Infrastructure Security Agency (CISA),

“Ransomware is an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.”

What can you do to prevent ransomware? CISA, in collaboration with the Multi-State Information Sharing and Analysis Center (MS-ISAC), has developed a Ransomware Guide (September 2020) to include prevention and response tips and best practices. Some prevention best practices include:

  • Maintain offline and encrypted backups of your data and be sure to regularly test these backups
  • Develop a cyber incident response plan and associated communications plan
  • Conduct regular vulnerability scanning, patch and software updates
  • Ensure all devices are properly configured and security features are enabled
  • Implement best practices for use of Remote Desktop services
  • Disable or block Server Message Block (SMB) protocol outbound and remove or disable outdated versions

“As critical OT industries, such as  energy and renewables, continue to digitally transform, they can mitigate damages by implementing a cyber resiliency approach that leverages zero-trust architectures throughout the OT supply chain, restricting the attacker’s ability to move latterly in all environments,” says Jyoti Wadhwa, T-Rex’s lead Cybersecurity Solutions Architect.

In addition to the above best practices, learn more about preventing various types of cyber-attacks. Read our blog post on Modern Cybersecurity: Modern Resilience.


recently posted
Protecting Government Apps and Workloads from Zero-Day Cyber Threats

Protecting Government Apps and Workloads from Zero-Day Cyber Threats

In April 2023, CISA released Zero Trust Maturity Model Version 2, which added a fourth security maturity level and reaffirmed application and workload cyber requirements. In this article we consider Application Threat Protections security levels within the Applications and Workloads […]

Dr. Allen Harper on How T-Rex Helps Federal Agencies Meet the Zero Trust Challenge

Dr. Allen Harper on How T-Rex Helps Federal Agencies Meet the Zero Trust Challenge

The White House Executive Order (EO) 14028 “Improving the Nation’s Cybersecurity” calls for Federal agencies to adopt and implement zero trust architecture. In a recent interview with Washington Exec, T-Rex’s Executive Vice President of Cybersecurity Dr. Allen Harper discusses the […]

Enhancing a Security Hardening Validation Script through Sourcery AI

Enhancing a Security Hardening Validation Script through Sourcery AI

This blog post covers Sourcery’s integration with Visual Studio Code and Python, two standard tools included in security professionals’ development stacks. Sourcery is available at https://sourcery.ai and the Microsoft Visual Studio Code Extensions tab. To demonstrate Sourcery’s capabilities, we will […]

Exceed Cloud Migration Expectations with T-Rex and AWS

Exceed Cloud Migration Expectations with T-Rex and AWS

T-Rex continues to implement large scale cloud transitions with Amazon Web Services (AWS). Learn about the winning T-Rex/AWS collaboration on the 2020 Census: