Sierra Wireless Becomes Latest Ransomware Attack Victim

Sierra Wireless, one of the world’s leading IoT solutions providers, recently announced it was a victim of a ransomware attack.

Last March 23rd, Sierra Wireless announced that it discovered on March 20, 2021, it was hit by a ransomware attack.

In a ransomware attack, computer files are encrypted, blocking a victim from accessing these files. A ransomware attacker then demands from the victim to pay a specified amount in exchange for the decryption key that would unlock the encrypted files.

In recent months, it has become a trend among ransomware attackers to demand from ransomware victims a second ransom demand in exchange for the non-publication of data stolen during the ransomware attack. In the case of the ransomware attack on Sierra Wireless, it wasn’t disclosed whether or not the attacker or attackers demanded the second ransom or whether or not the company paid ransom.

As a result of the ransomware attack, Sierra Wireless said it halted production at its manufacturing sites. The company added that its corporate website and other internal operations have also been disrupted by the ransomware attack.

As a result of the ransomware attack, Sierra Wireless said it was withdrawing its First Quarter 2021 guidance. In February 2021, the company released its 2020 full year revenue and First Quarter 2021 guidance.

Sierra Wireless reported that its total revenue reached $448.6 million in 2020. For the First Quarter of 2021, the company said it projected to earn $109.9 million. In its March 26th update about the ransomware attack, Sierra Wireless said it has resumed production and started to recover its internal systems.

“Sierra Wireless maintains a clear separation between its internal IT systems and its customer-facing products and services,” the company said. “Sierra Wireless believes that the impact of the attack was limited to Sierra Wireless’ internal systems and corporate website, and that its products and connectivity services were not impacted, and its customers’ products and systems were not breached during the attack.”

The company added that it doesn’t expect that there will be any product security patches, or firmware or software updates required as a result of the ransomware attack.

Prevalence of Ransomware Attacks

IBM reported that ransomware was the cause of nearly one in four real-life cyberattacks worldwide that the company responded to in 2020. IBM added that ransomware attacks in 2020 were “aggressively evolving to include double extortion tactics.”

According to IBM, the group behind the ransomware called “Sodinokibi” – the most commonly observed ransomware group in 2020 – earned over $123 million in 2020, with nearly two-thirds of its victims paying a ransom. IBM added that the group behind Sodinokibi stole from victims approximately 21.6 terabytes of data and approximately 43% of ransomware victims had their data leaked for the public to see.

IBM further reported that Sodinokibi and the other successful ransomware groups in 2020 were focused on stealing and publishing the data of victims who refused to pay ransom.

IBM added that the most successful ransomware groups in 2020 were focused on creating ransomware-as-a-service cartels. In ransomware-as-a-service, one group maintains the ransomware code and another group, known as affiliates, spread the ransomware. Affiliates are known to distribute ransomware in any way they like.

In the blog post “McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us,” McAfee Labs reported that while Sodinokibi ransomware affiliates used different modus operandi, it did notice many started with a breach of Remote Desktop Protocol (RDP) – a proprietary protocol developed by Microsoft that allows Windows users to remotely connect to another Windows computer.

RDP servers that are exposed to the internet through the use of weak passwords and unprotected by multi-factor authentication (MFA), virtual private networks (VPNs), and other security protections, are of particular interest to cyberattackers. RDP is often breached via brute force attacks, in which the attacker submits many username and password combinations in the hope of guessing the correct combination.

“Through RDP brute force, threat actor groups can gain access to target machines and conduct many follow-on activities like ransomware and coin mining operations,” Microsoft Defender Security Research Team said in the blog post "Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks."

Cybersecurity Best Practices Against Ransomware

Network segmentation is one of the cybersecurity best practices in protecting your organization’s network from ransomware. In network segmentation, your organization’s IT network is divided into sub-networks so that in case something bad happens to one sub-network, the other sub-networks won’t be affected. In the case of Sierra Wireless ransomware attack, the company said it maintains a clear separation between its internal IT systems and its customer-facing products and services.

It’s also important to backup your organization’s critical data regularly, following the 3-2-1 backup rule. In 3-2-1 backup rule, 3 copies of your organization’s critical data are kept, with copies stored on 2 different media, and one of these copies must be kept offsite for disaster recovery.

As mentioned, one of the favorite entry points of ransomware attackers into their victims’ networks is via RDP servers exposed to the internet. Protect RDP servers via strong passwords, MFA, VPN, and other security protections.

Is Network-Level Blocking the Right Solution to Limiting Botnet Traffic?

The Government of Canada, through the Canadian Radio-television and Telecommunications Commission, recently called on stakeholders to comment on its proposal to develop a network-level blocking framework that will limit the harm botnets cause to Canadians.

In the "Call for comments – Development of a network-level blocking framework to limit botnet traffic and strengthen Canadians’ online safety," the Commission said it’s the principal enforcement agency for the Personal Information Protection and Electronic Documents Act and the Telecommunications Act – Canada’s Anti-Spam Legislation, also known as CASL. “Botnet activity is by definition a CASL violation, as is the botnet itself,” the Commission said. “One way that TSPs [telecommunications service providers] can limit anti-CASL behaviour is by blocking botnet traffic.”

What Are Botnets?

Botnets are networks of hijacked computers that are infected by malicious software (malware). One way by which this malware arrives on the hijacked computer is through phishing – a type of cyberattack in which the attacker masquerades as a trusted entity and tricks an email receiver to click on a malicious attachment or link.

Clicking this malicious attachment or link could lead to the downloading and running of malware on the email recipient’s computer. Once the malware is inside the victim’s computer, it contacts the attacker’s command and control center, allowing the attacker to control the malware-infected computer and using it to commit cybercrimes such as further phishing campaigns, credential stuffing, ransomware, or distributed denial-of-service (DDoS).

Botnets Cybercrimes

According to Commission, botnets are the basis for an increasingly large proportion of cyber threats to individuals, corporations, and institutions in Canada.

In mid-March this year, Canada Revenue Agency (CRA) announced that it locked out 800,000 CRA user IDs and passwords as they may have been obtained by unauthorized third parties or have been identified as being available to unauthorized individuals.

CRA said, “We wish to reiterate that these user IDs and passwords were not compromised as a result of a breach of CRA’s online systems, rather they may have been obtained by unauthorized third parties and through a variety of means by sources external to the CRA, such as email phishing schemes or third party data breaches.”

In August 2020, the Government of Canada, through the Treasury Board of Canada Secretariat, reported that attackers fraudulently accessed nearly 5,500 CRA accounts. In a press conference in August 2020, Marc Brouillard, acting Chief Technology Officer for the Treasury Board of Canada Secretariat said that at one point, the CRA web portal was attacked by a large amount of traffic using a "botnet to attempt to attack the services through credential stuffing".

Credential stuffing, also known as account takeover, uses a large number of stolen username and password combinations from other websites and tests these stolen credentials to login to a target website. Credential stuffing are launched through botnets and across different IP addresses.

Network-Level Blocking Framework Proposal

The Commission proposes that telecommunications service providers can introduce network-level blocking using a variety of techniques such as domain-based blocking, Internet Protocol (IP)-based blocking, and protocol-based blocking.

“Internet users access websites by clicking on links or by entering domains (www.example.com) into a browser,” Commission said. “To access a webpage, the domain has to first be translated into the IP address of the server that hosts the webpage. This translation happens through the Domain Name System (DNS), which maps domain names to IP addresses. Once the IP address is found, the Internet user’s device can then route communication to the website’s server and download the webpage.”

In domain-based blocking when an infected device requests a blocklisted command and control domain, the DNS will either reply that the domain is unknown or will redirect the user to a site stating that the requested domain isn’t permitted.

In IP-based blocking, a firewall is used to prevent communication to the IP addresses of suspected command and control servers while letting other communication through. Protocol-based blocking, meanwhile, refers to a targeted form of IP-based blocking limited to a select group of services on a specified server.

In its reply to the network-level blocking framework proposal, the Royal Canadian Mounted Police (RCMP) said it supports the Commission’s proposal as “criminal botnet operations and infrastructure continues to underpin various cybercrime threats, such as ransomware, Distributed Denial of Service (DDoS) attacks, campaign-level phishing activities, among other cyber intrusions.”

RCMP said that in 2016, it took part in a global effort to dismantle the network called “Avalanche,” which included a botnet infrastructure that facilitated the widespread malware attacks targeting financial institutions and other sectors. RCMP said that the dismantlement of the Avalanche network, which spread across 30 countries, resulted in multiple arrests, seizures of command and control server infrastructure, and over 800,000 domains were seized, sinkholed, or blocked.

In response to the Commission’s proposal, Bell Canada said, “There is no one-size-fits-all detection and mitigation method.” It added that once the Commission approves one type of blocking “malicious actors can be expected to change their techniques and implement new botnet strategies to evade the regulated mandatory form of blocking.”

In response to the Commission’s proposal, Rogers Communications said, “Blocking of botnet traffic is a highly technical matter that requires in-depth security intelligence.” It added that the “proposal for a single network blocking framework is not the best approach to tackle cyber crime.”

Telus Communications, for its part, said, “The Commission’s proposal to focus on TSPs in an effort to limit botnets is a narrow approach that, absent other stakeholder action, will be ineffective.” It added that network-level blocking is a “reactive measure – it is not implemented until malicious traffic is detected from an already

infected device.”

Canada Revenue Agency (CRA) Locks Out 800,000 Accounts 

The Canada Revenue Agency (CRA) recently revoked 800,000 CRA user IDs and passwords. According to the CRA, the IDs and passwords “may have been obtained by unauthorized third parties” or “have been identified as being available to unauthorized individuals.”

“Out of an abundance of caution, and to prevent unauthorized access to these accounts, the CRA took swift action to lock these accounts,” CRA said in a statement. “The total number of accounts impacted is roughly 800 thousand.”

The Agency said the revocation of the hundreds of thousands of CRA user IDs and passwords wasn’t a result of a breach of CRA’s online systems. The Agency attributed the cause of the revocation to external causes, including email phishing schemes or third-party data breaches. “We wish to reiterate that these user IDs and passwords were not compromised as a result of a breach of CRA’s online systems, rather they may have been obtained by unauthorized third parties and through a variety of means by sources external to the CRA, such as email phishing schemes or third party data breaches,” CRA said.

Past Data Breach

In August 2020, the Government of Canada, through the Treasury Board of Canada Secretariat, issued a statement about the data breach on the Canadian Government's GCKey – a system used by 30 Canadian federal departments as a single sign-on (SSO) system to access government services. GCKey is particularly used to access the CRA accounts.

According to the Treasury Board of Canada Secretariat, out of the nearly 12 million active GCKey accounts in Canada, the passwords and usernames of 9,041 users were acquired fraudulently and used to access government services. The Treasury Board of Canada Secretariat added that out of the total number of accounts fraudulently accessed by the attackers, nearly 5,500 CRA accounts were fraudulently accessed.

Tests conducted by BleepingComputer on CRA’s web portal showed that multi-factor authentication and security CAPTCHA (short for Completely Automated Public Turing Test To Tell Computers and Humans Apart in use) weren't enabled. "When signing-in from a new computer, the user would be asked a security question (e.g. pet's name), however, there is no mechanism prompting the user for a 2FA code, for example, to be sent via a text message (SMS)," BleepingComputer said.

In a press conference in August 2020, Marc Brouillard, acting Chief Technology Officer for the Treasury Board of Canada Secretariat said that at one point, the CRA web portal was attacked by a large amount of traffic using a "botnet to attempt to attack the services through credential stuffing". Brouillard said the attackers bypassed the CRA security questions and fraudulently access CRA accounts by exploiting a vulnerability in the configuration of security software solutions that the Government of Canada used.

Cyberattack Methods

The acting Chief Technology Officer for the Treasury Board of Canada Secretariat mentioned three methods of attacks used by the attackers in the 2020 CRA web portal data breach: botnet, credential stuffing, and exploitation of a software security vulnerability. The recent cyber incident at the CRA, meanwhile, was attributed to email phishing schemes or third-party data breaches.

Botnet

Botnet, also known as zombie army, is a cyberattack that uses a group of hijacked computers (including IoT devices), each injected with malicious software (malware) and controlled by the attacker from a remote location without the knowledge of the computer's owner.

Credential Stuffing

Credential stuffing is a cyberattack in which an attacker uses a large number of stolen username and password combinations from other websites and tests these stolen credentials to login to other websites. This type of attack is based on the assumption that username and password combinations are typically reused. To scale the process of testing these stolen credentials from one website to another website, botnets are used to automate the process.

Exploitation of Software Security Vulnerability

In the exploitation of software security vulnerability, an attacker exploits either a publicly known software security vulnerability or a security vulnerability that’s only known to the attacker. In most cases, attackers exploit known security vulnerabilities and those with available fix, also known as a patch, as attackers assume that users delay the application of the available patch.

Email Phishing

Email phishing is a type of cyberattack in which the attacker masquerades as a trusted entity, and tricks the victim into opening an email. The email recipient is further tricked into opening a malicious attachment or link, which can lead to the installation of malware on the email recipient’s computer, enabling the attacker to conduct malicious activities on the email recipient’s computer. Activities could include stealing of sensitive information.

Third-Party Data Breaches

Third-party data breach, also known as supply chain attack, is a type of cyberattack in which an attacker infiltrates the systems of the initial victim with the end goal of infiltrating the customers of the initial victim.

Cybersecurity Best Practices

As exemplified in the August 2020 data breach at the CRA and the recent cyber incident at the CRA, attackers are employing not just one but multiple attack methods in order to compromise their target. Below are some of the best practices in order protect your organization from the above-mentioned cyberattack methods:

• Use CAPTCHA
• Use multi-factor authentication (MFA)
• Use Web Application Firewall – allowing legitimate traffic and preventing malicious traffic
• Keep all software up to date
• Train employees to be on guard of suspicious emails
• Practice network segmentation – a practice in which a network is subdivided into sub-networks. This ensures that if anything bad happens to a sub-network, the other sub-networks won’t be affected.

Patch Time: Microsoft Issues Patches for Exchange Server Zero-Day Threats

Microsoft recently issued out-of-band security updates for zero-day vulnerabilities affecting Microsoft Exchange Server.

Out-of-band security updates refer to security updates released outside the normal release time. Zero-day vulnerabilities, meanwhile, refer to software security vulnerabilities that are exploited before updates become available.

Microsoft Exchange Server is Microsoft's email server solution that’s available both on-premise and online. This email server solution runs exclusively on Windows Server operating systems. Exchange servers are primarily used by organizations. As such these Exchange servers are high-value targets.

In the blog post "HAFNIUM targeting Exchange Servers with 0-day exploits," Microsoft Threat Intelligence Center, Microsoft 365 Defender Threat Intelligence Team, and Microsoft 365 Security said that on-premises Exchange servers are affected by the zero-day vulnerabilities, while Exchange online isn’t affected. On-premises Exchange servers that are specifically affected are Exchange Server 2010, Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019.

Microsoft Exchange Server Zero-Day Vulnerabilities

According to Microsoft Threat Intelligence Center, Microsoft 365 Defender Threat Intelligence Team, and Microsoft 365 Security, the threat actor, collectively called “Hafnium,” used the following zero-day vulnerabilities in on-premises Exchange servers to initially access their victims’ networks:

CVE-2021-26855: A server-side request forgery (SSRF) vulnerability in on-premises Exchange servers that allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

CVE-2021-26857: This vulnerability allowed the attacker to run code as SYSTEM on the Exchange server. This vulnerability, however, needs administrator permission or another vulnerability to exploit.

CVE-2021-26858: After exploiting CVE-2021-26855 or by compromising a legitimate admin’s credentials, this vulnerability allowed the attacker to write a file to any path on the server.

CVE-2021-27065: Similar to CVE-2021-26858, after exploiting CVE-2021-26855 or by compromising a legitimate admin’s credentials, this vulnerability allowed the attacker to write a file to any path on the server. 

“After exploiting these vulnerabilities to gain initial access, HAFNIUM operators deployed web shells on the compromised server,” Microsoft Threat Intelligence Center, Microsoft 365 Defender Threat Intelligence Team, and Microsoft 365 Security said. “Web shells potentially allow attackers to steal data and perform additional malicious actions that lead to further compromise.”

By exploiting these 4 zero-day vulnerabilities, the attacker was able to bypass authentication, including two-factor authentication. These vulnerabilities allowed the attacker to access email accounts that are of interest within the targeted organizations and allowed the attacker to remotely execute code on vulnerable Microsoft Exchange servers.

Researchers from Volexity and Dubex were credited by Microsoft for reporting about the zero-day vulnerabilities in on-premises Exchange servers. Security researchers at Volexity and Dubex reported that the zero-day exploits in on-premises Exchange servers started as early as January 2021.

Security researchers at Volexity reported that in January 2021 they detected anomalous activity from two of its customers’ Microsoft Exchange servers. The Volexity security researchers said they identified a large amount of data being sent to IP addresses it believed weren’t tied to legitimate users.

Dubex security researchers said they observed the zero-day exploit in a set of Exchange servers in Denmark. They particularly observed CVE-2021-26857, an insecure deserialization vulnerability in the Unified Messaging service. “Through analysis of the systems, Dubex Incident Response Team determined that feeding the UM [Unified Messaging] Server with a sufficiently malformed voicemail file caused it to spawn a UMWorkerProcess that deserialised the voicemail and executed contents,” Dubex security researchers said.

In the blog post "New nation-state cyberattacks," Tom Burt, Corporate Vice President, Customer Security & Trust at Microsoft, said that Hafnium, the group behind the zero-day exploits in on-premises Exchange servers, operates from China. Hafnium, he said, targets research organizations, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.

Burt added Hafnium attacked by following these three steps: “First, it would gain access to an Exchange Server either with stolen passwords or by using the previously undiscovered vulnerabilities to disguise itself as someone who should have access. Second, it would create what’s called a web shell to control the compromised server remotely. Third, it would use that remote access – run from the U.S.-based private servers – to steal data from an organization’s network.”

Preventive and Mitigating Measures

According to Microsoft, zero-day vulnerabilities in on-premises Exchange servers, which include CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, are all part of an attack chain. The initial attack, Microsoft said, requires the ability to make an untrusted connection to Exchange server port 443.

To prevent the initial attack, Microsoft recommends protection against untrusted connection to Exchange server port 443. To separate the Exchange server from external access,

Microsoft recommends setting up a virtual private network (VPN).

Microsoft, however, noted that protection against untrusted connection to Exchange server port 443 and setting up a VPN only serve as protection against the initial portion of the attack. The company warned that other portions of the attack chain can be triggered if an attacker already has access or can convince an administrator to open a malicious file.

If the latest security updates can't be immediately deployed, it’s recommended to restrict external access to OWA URL, restrict external access to Exchange Admin Center (EAC), and disconnect vulnerable Exchange servers from the internet until the latest security updates can be applied. 

Microsoft recommends the following best practices to better defend on-premises Exchange servers:

• Deploy the latest security updates, especially for Microsoft Exchange Server, as soon as they become available.
• Use security solutions such as firewall protection, multi-factor authentication (MFA), and VPN.
• Regularly review privileged groups such as Administrators, Remote Desktop Users, and Enterprise Admins. Attackers typically add their own accounts to these groups to establish a foothold on a server. Review these privileged groups for suspicious additions.
• Restrict access by avoiding the use of domain-wide, admin-level service accounts, and by enforcing strong randomized, just-in-time local administrator passwords.

1 in 4 Cyberattacks in 2020 Caused by Ransomware, IBM Report Shows

IBM’s latest report, X-Force Threat Intelligence Index 2021, found 1 in 4 real cyberattacks worldwide in 2020 was caused by ransomware.

Double Extortion Tactic

Ransomware is a malicious software (malware) that encrypts victims’ computer files. File encryption prevents legitimate users from assessing their files. Ransomware attackers are publicly coming out that they’re also stealing victims’ data prior to encrypting these files. 

IBM's X-Force Threat Intelligence Index 2021, which the company said is based on billions of data points collected from its customers and public sources between January and December 2020, showed that a number of the ransomware attacks in 2020 involved double extortion – a tactic in which the attackers demand ransom two ransoms. Aside from demanding from victims to pay ransom in exchange for the decryption key that would unlock the encrypted files, attackers also demand a second ransom payment, this time, as payment to stop the attackers from selling or auctioning the victims’ stolen files.

According to IBM, in 2020, 36% of the data breaches that X-Force (IBM’s cloud-based threat intelligence platform) tracked came from ransomware attacks that also involved alleged data theft, suggesting that “data breaches and ransomware attacks are beginning to collide.”

Sodinokibi Ransomware

According to IBM, Sodinokibi, also known as REvil, was the most active ransomware in 2020, accounting for 22% of all ransomware incidents.

IBM estimated that the group behind the Sodinokibi ransomware earned at least $123 million in 2020 and stole about 21.6 terabytes of data from victims. IBM added that nearly two-thirds of the victims of Sodinokibi paid ransom, and nearly 43% had their stolen data leaked to the public.

Sodinokibi was first observed in the wild in April 2019. When it first came out, Sodinokibi was observed spreading itself by exploiting a vulnerability in Oracle’s WebLogic server.

Ransomware-as-a-Service Cartels

According to IBM, Sodinokibi and other successful ransomware groups in 2020 were focused on stealing and leaking data, as well as creating ransomware-as-a-service cartels. 

One of the reasons behind the notoriety and the resulting success of ransomware groups is that these groups operate in what is known as ransomware-as-a-service. In ransomware-as-a-service, one group maintains the ransomware code and another group, known as affiliates, spreads the ransomware.

Affiliates in ransomware-as-a-service are allowed to spread the ransomware in any way they like. In the blog post "McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us," McAfee Labs found that some affiliates prefer mass-spread attacks, while other affiliates adopt a more targeted approach.

Examples of mass-spread attacks are phishing and exploit kits. Phishing is the fraudulent way of obtaining sensitive information such as passwords and credit card details by impersonating a trusted individual or entity. Exploit kits, meanwhile, refer to threats that use automated tools to scan for vulnerable browser-based applications, compromised sites to divert web traffic, and run malware.

Cyberattacks that employ a targeted approach, meanwhile, refer to attacks targeting specific individuals or specific entities. Examples of targeted approaches include brute-forcing Remote Desktop Protocol (RDP) access.

RDP is a proprietary protocol developed by Microsoft that allows a Windows-based user to connect to a remote Windows personal computer or server over the internet. After brute-forcing RDP access, attackers then upload tools in order to gain more rights and run the ransomware inside the internal network of a victim.

“We have investigated several campaigns spreading Sodinokibi, most of which had different modus operandi but we did notice many started with a breach of an RDP server,” McAfee Labs said.

Cost of a Ransomware Attack

In its latest report, Universal Health Services said the company incurred $67 million as a result of an “Information Technology Incident” that occurred from September 27, 2020 up to October 2020.

TechCrunch reported the Universal Health Services information technology incident as ransomware attack. BleepingComputer, meanwhile, reported that the specific name of the ransomware behind the Universal Health Services information technology incident is Ryuk – a ransomware first discovered in the wild in August 2018.

Universal Health Services said there’s no evidence of unauthorized access, copying, or misuse of any patient or employee data.

“Given the disruption to the standard operating procedures at our facilities during the period of September 27, 2020 into October, 2020, certain patient activity, including ambulance traffic and elective/scheduled procedures at our acute care hospitals, were diverted to competitor facilities,” Universal Health Services said. “We also incurred significant incremental labor expense, both internal and external, to restore information technology operations as expeditiously as possible. Additionally, certain administrative functions such as coding and billing were delayed into December, 2020, which had a negative impact on our operating cash flows during the fourth quarter of 2020.”

Security researchers aren’t certain about the infection vector of Ryuk ransomware. It’s suspected that this ransomware uses the targeted attack approach by brute-forcing RDP access and malicious use of Cobalt Strike.

Cobalt Strike is a commercial penetration testing tool that markets itself as "adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors." This commercial penetration testing tool uses tools such as Mimikatz – a tool that’s capable of obtaining plaintext Windows account logins and passwords.

Cybersecurity Best Practices Against Ransomware Attacks

Below are some of the cybersecurity best practices against ransomware attacks:

• Keep all software up to date
• Use strong passwords
• Use multi-factor authentication (MFA)
• Use Virtual Private Network (VPN)
• Use network Firewall
• Educate users to help lessen the threat of phishing attacks by enforcing secure practices such as the policy against clicking external email links.
• Implement the 3-2-1 backup rule: 3 copies of critical data must be kept with 2 copies in different media and one copy offsite for disaster recovery.