Comprehensive protection against ransomware-Security Center(Security Center)-阿里云帮助中心

Ransomware can infiltrate your servers or databases and encrypt your business data, demanding a ransom. This can disrupt your business, expose your data, and result in data loss. This topic describes common vulnerabilities that lead to ransomware attacks and provides comprehensive strategies to protect your systems.

Background

Attackers can exploit the following vulnerabilities in your business systems:

Critical accounts have weak passwords or no authentication.
- Key server accounts, such as root and administrator, have simple passwords or no passwords at all.
- Important services like databases (Redis, MongoDB, MySQL, MS SQL Server) use weak passwords or no passwords.
No access control policies are in place, exposing services directly to the internet.
High-risk services such as RDP, SSH, Redis, MongoDB, and MySQL are directly accessible from the internet.
Server operating systems and software contain high-risk vulnerabilities.
Attackers can exploit these vulnerabilities in server operating systems and application software to upload ransomware or execute malicious commands for remote attacks.

To reduce the risk of ransomware attacks on your business systems, implement the following security measures.

Classify assets by criticality

Classify your assets, such as servers, application code, and data, by their criticality. Develop different protection strategies for sensitive data and routine data.

Segment your network into zones. Use features like Cloud Firewall or security groups to implement micro-segmentation and restrict access to high-risk zones.
Deploy sensitive systems and data in separate locations.
Evaluate which services need to be exposed to the internet. For services that do not require public access, provide only internal access channels.

Back up and restore data

Reliable data backups can minimize damage from ransomware. You must also secure these backups to prevent them from being infected or corrupted.

Maintain at least two copies of your data: one local backup and one off-site backup.
Use multiple backup methods to maximize your chances of recovery after a ransomware incident.

You can use the following methods:

Use the ECS snapshot feature to back up data. For more information, see Create a snapshot manually.
Use the data backup feature provided by RDS. For more information, see Back up SQL Server data.
Use OSS to back up important data files. For more information, see Back up a bucket.
Develop your own data backup policies, such as creating backups for self-managed databases like MySQL.

Recommended products: ECS snapshot, Security Center

Security policies for critical accounts

Alibaba Cloud account (root account)
Alibaba Cloud provides features like multi-factor authentication (MFA), password security policies, and audit trails. You can log on to the RAM Console to enable and configure these features to secure your cloud account.
For organizations with multiple roles, use the identity management features of Resource Access Management (RAM) to assign accounts and grant permissions based on job functions. This helps prevent security risks from accidental operations.
Privileged accounts
If you use ECS instances to host critical services such as databases, file services, or caching, you must properly configure and protect the associated accounts and passwords.
- Do not expose these high-risk services to the internet.
- Enable authentication and authorization features.
- Do not use the root account to log on directly to an ECS instance.
- If you use a Windows operating system, rename the default administrator account.
- Configure strong passwords for all services. A strong password must be at least eight characters long and include uppercase and lowercase letters, numbers, and special symbols. It should not contain usernames, real names, company names, or complete words.

Recommended products: Security Center, Bastionhost

Strengthen network access control

Many enterprise network architectures lack segmentation. If a breach occurs, the entire business can be affected. By implementing effective security zones, access controls, and admission mechanisms, you can limit lateral movement and slow the spread of an attack, preventing unauthorized access to your environment.

For example, you can configure access control for management protocols like SSH and RDP. You should also restrict access to data-related services such as FTP, Redis, MongoDB, Memcached, MySQL, MS SQL Server, and Oracle by source IP address. This minimizes the attack surface by only allowing trusted IP addresses and enables you to analyze and audit outbound network traffic in real time.

We recommend that you use a secure VPC network.

Use VPCs and security groups to divide your network into zones with different security levels. This places different services in isolated network environments.
Configure inbound and outbound security group rules to filter both incoming and outgoing traffic. The following examples describe how this works:
- Common database services do not need to be directly managed or accessed from the internet. You can configure inbound access control policies to prevent database exposure and reduce the risk of compromise.
- Prohibit direct remote logon over the internet by using protocols like SSH and RDP. For routine server management, use encrypted channels and strong passwords for authentication. We recommend using Bastionhost to centrally manage and audit all logon activities.
- Configure strict internal network access control policies. For example, configure an inbound rule that allows only a specific internal IP address to access a designated database server.

Build a resilient business infrastructure

In a cloud environment, you can use SLB clusters to build a high availability architecture. If a node fails, this architecture seamlessly fails over to a standby node, preventing business disruptions and data loss.

If resources permit, set up same-city or off-site disaster recovery systems. If the primary system is compromised by a ransomware attack, you can quickly switch to the backup system to ensure business continuity.

We recommend a disaster recovery architecture built on high-performance services like SLB and RDS. For more information, see Alibaba Cloud Server Load Balancer (SLB) and Alibaba Cloud ApsaraDB RDS.

Scan external ports regularly

Port scanning helps you identify exposed vulnerabilities. If your organization has internet-facing services, you must determine which services need to be public and which require only internal access. The fewer services you expose to the internet, the smaller the attack surface, which lowers your security risk.

Recommended product: Managed Security Service

Perform regular security testing

IT administrators should regularly scan business software for security vulnerabilities. If you have internet-facing services, use vulnerability scanning tools to identify and fix any discovered issues promptly. You should also monitor security bulletins and patches from software vendors and promptly manage and remediate vulnerabilities.

Baseline security operations

Define and implement secure configuration baselines. Harden operating systems (Windows, Linux) and software (FTP, Apache, Nginx, Tomcat, MySQL) during initialization, and regularly validate their effectiveness.
Install antivirus software on Windows-based ECS instances and update the virus definitions regularly.
Apply security patches regularly.
Rename the default administrator account and configure strong passwords for all logon accounts.
Enable logging, centralize log management, and perform regular audits and analysis.
Assign accounts and permissions based on the principle of least privilege. Enable auditing features. For example, create accounts with different permission levels for servers and RDS databases and enable auditing. If possible, implement stricter access policies by using services like Bastionhost or a VPN.
Implement and maintain a strong password policy, and strictly log and audit all user operations.
Monitor all critical business components in real time. If an anomaly is detected, intervene immediately.

Recommended products: Security Center, Bastionhost, ActionTrail

Application code security

The security of your code directly impacts business security. Developers must integrate security architecture design into the software engineering process from the start. Follow a standard software development lifecycle (SDLC) and incorporate security considerations at every stage.

Pay close attention to the secure coding practices and security testing results of your developers or software vendors. Before deployment, perform code audits and post-deployment black-box testing on your business applications. You can also conduct periodic black-box penetration testing.

Recommended products and practices: Penetration Testing Service, Web Application Firewall, and a standard SDLC process

Global threat intelligence and awareness

Security is a continuous and dynamic process. To stay ahead of threats, you must understand and identify different types of external risks. While preventative measures are crucial, detection and response times are equally important. To enable fast and accurate threat alerts, you need a deep understanding of the external threat landscape and an effective monitoring and awareness system.

You can activate Security Center for free to gain real-time visibility into external attack behaviors and internal vulnerabilities.

Incident response plan and procedure

Security is an ongoing battle. We recommend that you prepare an emergency strategy for security incidents. After an incident occurs, follow a standardized incident response procedure to react quickly and minimize potential losses.

Recommended product: Managed Security Service

Employee security education and awareness

Develop a cybersecurity training curriculum for your employees. Conduct regular security awareness campaigns to familiarize them with company security policies. Raise awareness of cyber threats so that employees can recognize common phishing attempts and other security incidents and respond to suspicious activity.
Conduct regular information security training. For example, run simulated spear-phishing attacks to train employees to avoid visiting malicious websites or opening malicious attachments.
Provide a straightforward channel for employees to report phishing emails and other suspicious security events. This allows your security team to quickly understand current trends, respond to threats, and take appropriate action.

Recommended product: Managed Security Service