Last month, Lake City, Florida officials fired a member of their IT staff and announced plans to revamp their whole IT department after a careless click led to a ransomware infection of the city’s whole IT network, according to the ZDNet article “Florida city fires IT employee after paying ransom demand last week.”
An employee opened a document they got via email, which turned out to contain the Emotet Trojan, a type of malware. The Emotet Trojan also downloaded a TrickBot Trojan and Ryuk ransomware. After the latter spread through the network, the city ended up agreeing to pay a ransom of nearly half a million dollars, according to ZDNet.
This whole mess could have been prevented with some essential cybersecurity solutions, one of which is a technique called sandboxing. If you don’t have email sandboxing in effect already, here’s what you should know about it and why you should make it part of your organization’s IT security strategy to minimize your risk of getting hit with ransomware and other types of malware.
1. What is a malware sandbox?
In the tech world, a sandbox is basically an isolated virtual environment where you can test programs and files, according to TechTarget SearchSecurity’s definition of “sandbox (computer security).”
2. How does sandboxing work?
Cybersecurity experts use sandboxes to “detonate” suspicious files and programs in a place where they can’t infect the whole system/IT environment, TechTarget explains. In terms of email specifically, suspicious messages and files will get filtered into a sandbox for testing before they can reach your inbox.
If the potentially malicious file turns out to indeed contain malware, the harmful entity won’t be able to infect your network, since it will “go off” in isolation in the sandbox. Your files and data stay safe.
3. Why should my organization use sandboxing?
Hackers commonly use email to distribute malware and phish for sensitive data. Email is the most common point of entry in instances where organizations know how malware got installed, according to Verizon’s 2019 Data Breach Investigations Report. The report states that “the median company received over 90 percent of their detected malware by email.”
If you implement email sandboxing, you significantly reduce the odds that a malicious message will slip through and result in a breach/infection of your network. A solid approach to cybersecurity also involves adding other layers of protection aside from sandboxing, including network managed detection and response (MDR) and endpoint MDR.
We also recommend employee security awareness training to reduce the odds that someone will click on a suspicious link or attachment if a suspicious message slips through the cracks.
Ultimately, as the data breach epidemic continues and hackers continue to churn out new types of malware, you must take steps to stay ahead of cybercriminals seeking access to your IT environment. Otherwise, you could find yourself facing steep costs if your systems get infected with something like the Ryuk ransomware.
To learn more about sandboxing and other IT security strategies and solutions that can reduce your risk of a data breach, contact our team of cybersecurity experts today. We have a comprehensive portfolio of managed cybersecurity solutions – including email sandboxing and network and endpoint MDR. Our experienced security professionals can help you identify which products and services make sense for your business.
Get started and schedule an IT security assessment by calling 877-599-3999 or emailing sales@stratospherenetworks.com. Don’t wait until the damage is already done to take action against cybersecurity threats.
