by Jesper Kråkhede, Sweden
Posted in Security Architecture, Technology on Nov 5th, 2021
Every Swede of a certain age knows Anders F. Rönnblom´s ‘Det är inte snön som faller’ from 1980, the punk anti-Christmas song with the cartoon video that was shown on TV on Christmas Eve for years. I can´t get it out of my head this time of year, so here is my own security version. […]
Posted in Security Architecture, Technology on May 6th, 2021
Spring is well under way in Sweden. The birds are back, the evenings are getting longer and I see very little of it. Ransomware is everywhere right now. This month alone a major fuel pipeline in the US and the Irish health service have been hit, and those are only the ones that made the […]
Posted in Computer Forensics, Security Architecture, Technology on Nov 30th, 2020
Earlier this year security researchers described a ransomware attack with an interesting twist. Before encrypting anything, the attackers installed an old, legitimately signed hardware driver from a well-known manufacturer. The driver had a known vulnerability, and the attackers used it to load their own malicious driver into the Windows kernel. From there they could kill […]
Posted in Security Architecture, Technology on Oct 4th, 2020
Autumn has come to Sweden. The leaves are turning yellow and red and falling one by one. Looking at the incidents this year, I can´t help seeing the same pattern among companies. They fall one after another, and nearly always for the same reasons. A remote access server without a second factor. Domain admins logging […]
Posted in Security Architecture, Technology on Jul 2nd, 2020
I have written about it before but it bears repeating. The attackers love holidays. Christmas, Easter and here in Sweden especially July, when half the country is at the summer house. It´s not a coincidence. A ransomware group that has been inside your network for weeks can choose when to strike, and they choose when […]
Posted in Business, Security Architecture on Jan 19th, 2020
Just before New Year a large currency exchange company was hit by ransomware and is still struggling to get its services back. When I read about cases like that my first question is always the same: Could they restore? For management, backup has been an IT topic for decades. Something that costs money and that […]
Posted in Security Architecture, Technology on Jan 5th, 2020
Every time I help a customer recover from ransomware I ask myself what actually made the difference. After a few years the answer is surprisingly short. Three things: immutable backups, a bad network and a bad memory. Immutable backups first. A backup the attacker can reach is not a backup, it is just another target. […]
Posted in Security Architecture, Technology on Sep 19th, 2019
On the 16th of August 22 local governments in Texas were hit by ransomware on the same day. The common thread was not a clever zero-day. They shared the same IT service provider and the attackers came in through the provider´s remote management tool. Think about what such a tool is. Something that can logon […]