Mitigate ransomware and malware risks

COURSE OBJECTIVES

Upon completion of this course you should be able to:

1. Mitigate ransomware and malware risks.
2. Disable unneeded and unnecessary services.

PREREQUISITES

Course Prerequisites:

N/A

Students are expected to have a working knowledge of:

N/A

OUTLINE

1. What is Ransomware?

2. Prevention is better than regret

2.1 Mitigating the Risk

2.2 Protection on Desktops

3. Reacting to a Ransomware Attack

1. What is Ransomware?

Ransomware is malicious software which encrypts your files and holds them for financial ransom. You’ll have to pay money to get data back and there is no guarantee a ransomware developer will honor their commitment after payment.

2. Prevention is better than regret

The best way to ensure data security is to prevent attacks from taking hold in the first place. Keeping good backups is key to maintaining immunity from ransomware attacks and saving time and money. None of what is described in this article guarantees data restoration in the event of a malware attack and all data protection strategies carry a degree of risk. More strategies adopted means lower risk, but your mileage and situation may vary.

2.1 Mitigating the Risk

Changing Default Administrator Account Settings

Strong passwords are often neglected. This allows unauthorized parties to easily guess the password to inject code. ASUSTOR recommends changing your passwords regularly. Passwords should be at least eight digits with a mixture of upper case and lower case letters, numbers, and punctuation. The account named Admin should be disabled and a new admin account with a different name should be created in its place.

• Use a strong password and disable main Administrator account.
• To change your password in ADM, click the administrator account in Access Control and press Edit.

• To disable the admin account entirely, create a new admin account with a different name by clicking Add in Access Control.
• Sign into the new admin account, head over to Access Control, click the original admin account, click edit, click Disable this account.

Ensure ADM is Up-To-Date

ASUSTOR maintains its ADM operating system for ASUSTOR NAS devices. Updates come out for ADM on a regular basis, adding new features and fixing vulnerabilities. Remaining secure means always keeping your ASUSTOR NAS operating system and apps up to date.

• To update ADM, click ADM Update in Settings. Press Update Now to update the OS to the latest version if ADM is not up to date.

Turn on ADM Defender

Enable the Automatic blacklist to block repeated unauthorized login attempts. If any client’s IP address attempts to log in unsuccessfully a number of times within a certain period of time that client’s IP address will be blocked by ADM and can only be reversed by an authorized user.

Disabling Unnecessary Services

• If SSH and SFTP are not needed, they should be disabled. They can be enabled when needed. SFTP is needed for ASUSTOR EZ Connect. SSH is not often needed by most customers.
• If remote use is required, set only the ports that you need and whitelist only the devices that are supposed to connect. Set your NAS to deny connections from unknown devices.
• Please ensure port forwarding settings found in EZ Router under Settings are appropriate for your use case. For services or apps that are only used within a local network, it is advised to keep these ports closed. Forwarding or otherwise opening ports can lead to an increased risk of attacks to your NAS. For maximum data safety, always ensure data is properly backed up.

Avoid Using Preset Ports

Changing default access ports adds a layer of complexity. Leaving ports at their default values remove a layer of security as changing them adds a layer of guesswork and frustrates attempts to gain access to an ASUSTOR NAS. Ports 8000 and 8001 are the default for the main ADM web UI and are a possible entry point if the port number is known.

Securing your NAS with an HTTPS Certificate

If you decide to connect to your NAS remotely from a free Wi-Fi network or public computer, ensure that your NAS is secured with a valid HTTPS certificate. Instructions for setting up HTTP Secure on your NAS can be found here. HTTPS helps prevent attackers from sniffing passwords over a network and encrypts the data on a web page and personal information such as passwords. Only the website domain name is visible while content and pages are not.

2.2 Protection on Desktops

Avoid Browsing Unknown Websites

Some websites may contain links that invite downloads of malicious software. Please exercise caution when visiting unknown websites.

Protecting Against Desktop Ransomware

Some forms of ransomware found on PCs are able to infect files stored on a NAS. Some ransomware implementations are able to infect files on SMB shares and iSCSI drives. To mitigate risk of your computer infecting files on your NAS, ensure that SMB shares and iSCSI drives are disconnected with no passwords saved on your PC while only connecting to it using the NAS’s share name, ensure that your NAS has Btrfs enabled and regularly taking snapshots of your data, back up important data to a MyArchive drive and store it away from a network and have your NAS hibernate or remain off when not in use.

• Using SAMBA on an ASUSTOR NAS is only intended for use on a local network. If you add your NAS into the Demilitarized Zone or DMZ on your router or otherwise forward the SAMBA default port, the chances of ransomware attacks or other threats to your NAS will be increased.

Build up multiple backups

The best protection of your data is to back up files periodically. Provided that all the steps are taken, if an attack is successful, some or all data is likely to be easily restored. The 321 backup rule is a good rule of thumb in practicing data safety.

• At least three copies of data.
• Stored in two different types of storage spaces.
• At least one backup on an offsite location.

ASUSTOR NAS devices provide a myriad of options for backing up and data safety. Several are listed below:

• Backups to public cloud providers, including, but not limited to Dropbox, Google Drive, Microsoft OneDrive by DataSync Center.
• MyArchive cold storage drives
• Owning multiple NAS devices where one is a main NAS and the other is a backup.
• External storage backups
• Btrfs snapshots

Learn More: College 152 - Introducing 3-2-1-Compliant Backups

ASUSTOR’s MyArchive cold storage technology makes backing up easy. Manually copy and back up information to a hot swappable MyArchive drive and place it in a location away from the NAS. MyArchive drives can also be encrypted to prevent data theft in the event a drive is stolen.

Learn More: College 255 - Using MyArchive

Snapshot Center lets you create snapshots automatically or manually. If data is corrupt, or infected by ransomware, Snapshot Center is able to quickly restore data to a previous uninfected version as it keeps tabs on file modifications.

Learn More: College 252 - Introducing ASUSTOR Snapshot Center

3. Reacting to a Ransomware Attack

If you find yourself experiencing a ransomware infection, please disable Wi-Fi or disconnect your WAN cable ensuring that you are disconnected from the Internet. On an uninfected PC, check to see if NAS files are infected, if not, then attempt to roll back data on Snapshot Center to a previous version.

1. Disable Wi-Fi or pull of the Ethernet cable.
2. Delete suspected infected files. Take care to avoid deleting backups.
3. Attempt restoration of files by rolling back modifications in Snapshot Center.

If you've been affected by ransomware, please click here to read more about how to update ADM.

Learn More