Double Extortion is the New Normal – What Your Backup Strategy Might Be Missing

Table of content

• The Evolution of Digital Extortion
  
• Why Hybrid Work Environments Are at Risk
• Expanded Threat Surface in the Hybrid Model
• Building a Modern Defense Strategy
• The Human Shield
• Creating a Security-Conscious Culture
• Insider Threat Mitigation
• Preparing for Tomorrow’s Threats
  

 

 

The Evolution of Digital Extortion

Old-school ransomware was simple – attackers would encrypt your data and ask for money to decrypt it. With decent backups, you could recover your systems and keep going without paying.

 

Attackers have evolved. They now use what security professionals refer to as “double extortion” – a much more sinister tactic that leaves organizations in a no-win situation.

The attack unfolds in two phases. First, intruders silently penetrate your network and extract sensitive data. Only after stealing valuable information do they deploy encryption tools that lock down your systems.

 

When you discover the breach, you face two threats instead of one. Not only are your systems encrypted, but the attackers threaten to publish your confidential data unless you pay.

Even when you have perfect backups and recovery procedures, you remain exposed to cataclysmic data exposure.

 

Why Hybrid Work Environments Are at Risk

The fast transition to flexible work arrangements has introduced new security risks. Remote workers use company resources from multiple locations with varied devices – occasionally personal ones with little protection

This larger digital presence provides many potential avenues of attack. When employees access networks via public networks or disable security measures for ease, they unwittingly open up opportunities for breach.

After a criminal gains a presence, they are able to hide undetected in your systems for weeks or even months, collecting credentials and looking for valuable information before striking with their encryption attack.

Expanded Threat Surface in the Hybrid Model

The “anywhere, anytime, any device” workforce model fundamentally changes how security must be approached. According to research cited in the CrowdStrike report, ransomware attacks increased by a staggering 82% from 2020 to 2021 as criminals targeted these expanded attack surfaces. Traditional perimeter-based security simply cannot protect today’s distributed workforce.

Key vulnerabilities in hybrid environments include:

• Inconsistent Security Policies: Different security standards between office and remote environments create security gaps
• Complex Access Requirements: The need to provide seamless access to company resources regardless of location challenges conventional security approaches
• Personal Device Usage: Unmanaged personal devices often lack enterprise-grade protection yet connect to corporate resources
• Encrypted Threat Channels: Ransomware delivered over encrypted channels quintupled from February 2021 to March 2022, making detection more difficult
• Shadow IT Proliferation: Employees adopting unauthorized applications for productivity bypass security controls
• Reduced Visibility: Security teams have limited view into remote endpoint activities and network connections

The evolution from simple ransomware that merely locked files to sophisticated “double extortion” techniques demonstrates how threat actors have adapted their tactics. Today’s attacks involve data exfiltration before encryption, giving attackers leverage even when victims have proper backups in place.

Building a Modern Defense Strategy

Though backup options are still crucial, they need to be part of a larger security strategy that is intended to counter complex threats:

 

Early Detection Systems: Put in place sophisticated monitoring software that can detect abnormal network behavior and possible data exfiltration attempts. Modern solutions must leverage real-time telemetry data from endpoints and network traffic to identify potential threats. According to the CrowdStrike/Zscaler approach, this includes:

• Cloud-based sandboxing to analyze suspicious files inline before they reach endpoints
• Sharing of threat intelligence between endpoint and network security platforms
• Real-time device posture scoring to continuously evaluate endpoint security health
• Automated correlation of file hashes across the environment to quickly identify impacted systems

These capabilities allow organizations to detect zero-day threats before they can execute their payloads, providing critical time for security teams to respond.

Segmented Access Controls: Restrict user privileges to limit lateral movement in case attackers get past your perimeter. The Zero Trust security model fundamentally addresses this requirement by:

• Authenticating users directly to applications rather than networks
• Making applications invisible to unauthorized users
• Evaluating access requests based on identity, context, and device health
• Dynamically adjusting access permissions based on changing risk factors

This approach prevents compromised users or devices from accessing critical systems by continuously validating their security posture against defined policy thresholds.

 

Data Classification: Determine your most sensitive data and implement additional protection measures where they are needed most.Organizations should:

• Identify and categorize data based on sensitivity and regulatory requirements
• Apply stricter access controls to high-value assets
• Implement data loss prevention tools to monitor for unauthorized data movement
• Create custom access policies for different data categories based on user roles and device security status

By understanding what data needs the most protection, security teams can focus resources on safeguarding the organization’s crown jewels.

 

Endpoint Protection: Install strong security on every device that’s attached to your network, both remote and personal. Modern endpoint protection must:

• Collect comprehensive telemetry from endpoints to calculate security posture scores
• Detect and block malicious activity in real-time through behavioral analysis
• Share threat intelligence with network security tools to identify compromised devices
• Enable rapid remediation through automated response actions
• Provide visibility into the entire endpoint environment regardless of user location

With endpoints often being the initial attack vector for ransomware, robust protection at this layer is essential for preventing initial compromise.

 

Security Awareness Programs: Educate employees to identify social engineering techniques and have clear procedures in place for reporting suspicious behavior. Effective programs should:

• Provide regular, engaging training on current phishing and social engineering tactics
• Conduct simulated phishing exercises to test employee awareness
• Create simple reporting mechanisms for suspicious emails or activities
• Offer feedback and positive reinforcement for security-conscious behaviors
• Explain the “why” behind security policies to increase compliance

The human element remains critical in preventing ransomware attacks, as phishing and social engineering continue to be primary initial access vectors.

The Human Shield

Technology won’t fix this issue. Your team members are both your most vulnerable point and your best protection.

Regular training makes employees aware of phishing attempts – still the most common entry point for ransomware attacks. Establishing a culture in which security matters and suspicious behavior is reported in a timely manner can cut your risk profile dramatically.

When employees know how their behavior relates to organizational security, they become part of your defense strategy instead of a potential weak link.

Creating a Security-Conscious Culture

Building an effective human shield against ransomware requires more than occasional training sessions. Organizations must foster a security-first mindset throughout the company by:

• Leading from the top: Executive engagement and visible commitment to security practices
• Integrating security into workflows: Making secure practices convenient rather than burdensome
• Recognizing security champions: Identifying and rewarding employees who demonstrate excellent security behaviors
• Transparent communication: Sharing security incidents and lessons learned across the organization
• Continuous education: Providing ongoing training that evolves with changing threats
• Reducing blame: Creating an environment where mistakes can be reported without fear of punishment

The most effective security cultures normalize discussions about security, making it part of everyday work conversations rather than a separate, compliance-focused activity.

Insider Threat Mitigation

While most employees pose an unintentional risk, organizations must also address potential insider threats. The CrowdStrike and Zscaler integration specifically addresses this challenge through:

• Deception technology that deploys decoys within the organization’s network
• Preconfigured rules to detect suspicious internal activity
• Automated response actions when malicious behavior is identified
• Cutting off network access from compromised devices
• High-fidelity alerts about targeted attacks from within

These capabilities help organizations quickly identify compromised or malicious users before they can cause significant damage.

 

Preparing for Tomorrow’s Threats

The security landscape is always in flux. While companies become accustomed to double extortion strategies, criminals have already begun finding ways to pivot anew. A few are playing around with triple extortion techniques, victimizing not only the direct target but even their customers, business partners, or regulatory institutions.

Security on the forward-leaning track demands incessant innovation. Organizations require complete, integrated solutions for prevention, detection, response, and recovery – with backup schemes being just a part of that overall game.

The most effective organizations accept that absolute security is not achievable. Rather, they concentrate on creating multi-layered defenses which can detect attacks early, control breaches rapidly, and recover quickly when incidents are experienced.

If you realize that contemporary ransomware attacks aim to hit both your operations and reputation, you are able to devise strategies that guard your most prized digital assets within today’s growingly hostile cyber world.

Sources

• CrowdStrike 2022 Global Threat Report
• Zscaler 2022 ThreatLabz State of Ransomware Report
• CrowdStrike and Zscaler Joint Ransomware Whitepaper