Colonial Pipeline: Ransomware Is Not Slowing Down

Colonial Pipeline: Ransomware Is Not Slowing Down

Date: May 17, 2021
Tags: ,

Colonial Pipeline Company — one of the nation’s largest pipeline operators, supplying fuel across a 5,500-mile distance from Texas to New York — was recently attacked by ransomware. The ransomware attack forced Colonial Pipeline to shut down its systems and pause all operations. This attack will go down in history as one of the largest cyberattacks on U.S. critical infrastructure that has impacted millions of consumers and businesses.

The Federal Bureau of Investigation (FBI) has since confirmed that DarkSide was responsible for this ransomware incident. DarkSide is a criminal actor (as opposed to a nation-state actor) whose sole purpose is to profit from organizing ransomware attacks and share the proceeds with other ransomware developers.

According to the FBI’s Internet Crime Report, the Internet Crime Complaint Center received 2,474 complaints that were classified as ransomware in 2020 alone, accounting for a loss of $29.1 million, more than triple the amount in 2019. Ransomware is a growing problem.

Additionally, the increase in remote work caused by COVID-19 can also be attributed to the increase in ransomware attacks in 2020. Ransomware attacks have debilitating effects on information technology (IT) and operational technology (OT) across industries, especially those that support the nation’s critical infrastructure. So, what exactly is a ransomware attack? According to the Cybersecurity & Infrastructure Security Agency (CISA),

“Ransomware is an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.”

What can you do to prevent ransomware? CISA, in collaboration with the Multi-State Information Sharing and Analysis Center (MS-ISAC), has developed a Ransomware Guide (September 2020) to include prevention and response tips and best practices. Some prevention best practices include:

  • Maintain offline and encrypted backups of your data and be sure to regularly test these backups
  • Develop a cyber incident response plan and associated communications plan
  • Conduct regular vulnerability scanning, patch and software updates
  • Ensure all devices are properly configured and security features are enabled
  • Implement best practices for use of Remote Desktop services
  • Disable or block Server Message Block (SMB) protocol outbound and remove or disable outdated versions

“As critical OT industries, such as  energy and renewables, continue to digitally transform, they can mitigate damages by implementing a cyber resiliency approach that leverages zero-trust architectures throughout the OT supply chain, restricting the attacker’s ability to move latterly in all environments,” says Jyoti Wadhwa, T-Rex’s lead Cybersecurity Solutions Architect.

In addition to the above best practices, learn more about preventing various types of cyber-attacks. Read our blog post on Modern Cybersecurity: Modern Resilience.


recently posted
Zero Trust Lift: Network Visibility and Analytics Maturity using Zeek

Zero Trust Lift: Network Visibility and Analytics Maturity using Zeek

Zeek is a proven open-source network visibility and analytics tool that you can leverage to increase your agency’s Network Visibility and Analytics Capability maturity under CISA’s Zero Trust Maturity Model Version 2. Zeek (https://zeek.org, formerly named Bro) is a network […]

T-Rex is Hiring at Hill Air Force Base

T-Rex is Hiring at Hill Air Force Base

Since 2016, T-Rex has been supporting large scale hybrid-cloud migrations and systems modernization, to include the successful deployment of the first-ever online U.S. Census in 2020. We are excited about expanding our IT Modernization services within the National Security market, […]

Secure by Design and Zero Trust: Integrating Supply Chain Risk Management with DevSecOps

Secure by Design and Zero Trust: Integrating Supply Chain Risk Management with DevSecOps

Agencies are seeking innovative ways to mature their Zero Trust posture. In this article, we have focused on improvements to your DevSecOps to increase maturity in two pillars: 1) Devices and Applications and 2) Workloads.

Protecting Government Apps and Workloads from Zero-Day Cyber Threats

Protecting Government Apps and Workloads from Zero-Day Cyber Threats

In April 2023, CISA released Zero Trust Maturity Model Version 2, which added a fourth security maturity level and reaffirmed application and workload cyber requirements. In this article we consider Application Threat Protections security levels within the Applications and Workloads […]