Clearpath’s Blog on IT Infrastructure, Hybrid Clouds and IT Security

Remember those childhood games of “hide and seek”?  All the neighborhood children would get together in breathless anticipation of both finding the best hiding spots and the thrill of being discovered.  But the last thing you want when you are thinking about your network security is to play a game of hide and seek with malicious threats like hackers or ransomware.

Sure—your first line of defense is your firewall.   But it’s not, if some threat gets inside, but when threats get inside.  What is your response? Does finding out what’s happening turn into a game of hide and seek?  Or worse—is your approach strictly a forensic one?  Wouldn’t it be better to stop the threats as they are happening rather than simply reporting on what happened? 

All malware does not immediately trigger a security alert as some new variants are quite stealthy and designed to lay in wait until such time as they are activated. In this section we describe malware and in particular ransomware.

Northeastern University published an interesting piece, “Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks” Between 2006 and 2014, this research team analyzed 1,359 ransomware samples and found that a “close examination on the file system activities of multiple ransomware samples suggests that by… protecting Master File Table (MFT) in the NTFS file system, it is possible to detect and prevent a significant number of zero-day ransomware attacks.”