Cybersecurity is a constantly evolving field, with new threats regularly emerging that businesses must adapt to. One of the latest of these is leakware, a growing and concerning branch of ransomware. So what is leakware, and how can organizations protect themselves from it?
What Is Leakware?
Leakware began to surface in 2019 and has since become one of the fastest-growing types of ransomware. Instead of encrypting companies’ data and demanding a ransom to return it, leakware steals confidential information and threatens to release it unless targets pay a ransom.
For example, cybercriminals may break into a hospital’s electronic health records (EHR) system and steal patients’ names, addresses and medical information. If the hospital doesn’t pay a ransom, the criminals will leak the data, potentially endangering these patients and exposing the hospital to legal damages.
Companies in the medical and financial sectors and government contractors are at a higher risk of leakware than others. These businesses could face legal action or reputation damage from a breach of privacy, so they may be more willing to pay a higher ransom. Consequently, they’ve become favorite targets for leakware attacks.
Protecting Against Leakware
As more companies have started storing sensitive data, leakware has become a more prominent concern. Thankfully, it’s not a problem without a solution. Here are three crucial strategies for protecting against leakware.
1. Endpoint Detection and Response
Many leakware tools lie in hiding for some time, collecting as much data as possible before making their presence known. Endpoint detection and response (EDR) can find and remove these programs. Like antivirus programs, EDR continually monitors for potential threats, but it goes beyond traditional anti-malware measures.
EDR uses multiple malware detection methods, including looking for suspicious user activity and the misuse of legitimate programs. These more nuanced monitoring strategies make it easier to spot leakware as it accesses or moves sensitive files.
Small and medium-sized businesses don’t likely have IT teams large enough for manual monitoring, but many automated EDR programs exist. These solutions can help direct cybersecurity workers to potential threats before losing any data.
2. Email Security
Most ransomware attacks, including leakware, start as phishing attempts. As a result, companies can prevent many of these attacks by implementing better email security. First, they should install advanced email filters that can spot and automatically delete suspicious messages.
Second, and more importantly, businesses should train all of their employees to spot phishing attempts. These fraudulent emails often contain unusual links, web addresses, spelling errors or odd requests. Workers should also know to double-check sources before responding and never to give away sensitive information over email.
Without this training, employees may unknowingly give attackers access to company systems, letting them install leakware software. On the flip side, when they know how to spot and respond to these emails, they’ll prevent damaging attacks.
3. Zero-Trust Architecture
As leakware grows, companies can’t afford to take any chances with their sensitive data. Consequently, they may want to consider zero-trust security. Zero-trust strategies rely on restricting privileges and verifying everything to prevent and mitigate breaches.
The first part of implementing zero-trust architecture is segmenting networks. By dividing their data and processes into separate areas, businesses limit how much damage an attack can do. Without the ability to move laterally throughout a network, a breach in one area won’t affect the rest.
Next, zero-trust systems use methods like multi-factor authentication to verify users are who they claim to be before granting them access. Even then, every user will only have access to what they need, limiting what leakware can get. These steps are so effective that 30% of organizations worldwide have already started implementing them, with another 42% planning to do so.
Stay Safe From Emerging Threats
When businesses understand what leakware is, they can start to defend against it. This threat is concerning, but by following these steps, companies of any size can stay safe. As the data organizations hold becomes increasingly valuable, these security measures become all the more important.
