Taking Control of Ransomware and Other Malware with a Zero-Trust Strategy

In a classic “I Love Lucy” skit, Lucille Ball works at a chocolate factory. Her job is to wrap chocolates as they travel down a conveyor belt, without letting a single candy past. To keep up with the surging volume, she resorts to stuffing chocolates in her hat, her blouse and, finally, her mouth.

Cybersecurity pros dealing with malware at today’s government agencies might feel like they face a similar situation.

Taking ransomware as an example, 79 successful attacks struck U.S. government organizations in 2020, affecting 71 million people, according to Comparitech. Downtime and recovery costs reached an estimated $18.88 million, with downtime sometimes stretching several months. Overall, the United States suffered 65,000 attacks last year, more than seven per hour, NPR reports.

And while the number of malware sites declined, malware-spreading phishing sites have proliferated, with an average 46,000 detected every week in 2020, according to the Google Transparency Report. Meanwhile, 61% of security pros say their teams are understaffed, undermining defenses, ISACA says.

Antivirus software can certainly help. Signature analysis, heuristic analysis and other techniques can block a majority of the fusillade. But organizations outlay many millions of dollars on antivirus, and still, too many malware missiles reach over the ramparts. Clearly, antivirus is necessary but not sufficient.

The answer is not to pour more dollars into more malware detection. Rather, the solution is to achieve better malware prevention. And for that, agencies need to extend zero-trust cybersecurity to stamping out malware.

From Detection to Prevention

The concept behind zero trust is simple: Never trust, always verify. In other words, never implicitly trust any user or device to gain access to any of your networks or data. Rather, expressly authenticate and authorize every user or system on a least-privilege, need-only basis, every time that entity requests access.

But agencies typically apply zero trust to users, devices or systems. How can you widen the zero-trust net to cover malware? By taking a zero-trust approach to content.

Organizations create, send, receive and store vast quantities of content. Such content can include such common filetypes as Microsoft Word, Excel and PowerPoint, Adobe Acrobat, JPG and PNG image files, calendar files, and many more.

Unfortunately, that content can also conceal malware. Steganography can embed malicious executables, scripts and other code in common content files in ways that can evade antivirus scans. That code can activate at file download or file launch. It can also remain inactive for months till the “sleeper” malware awakens and begins moving laterally through your network.

In light of this reality, a zero-trust approach dictates that you don’t treat any content as safe, whether your organization created it internally, received it from an authenticated source, transmitted it only among authorized team members, or ran it through antivirus protections. The content isn’t trusted till you have actively rendered it trustworthy.

In short, you’re replacing malware detection with malware prevention.

CDR for Content Sanitization

The most effective way to replace detection with prevention is through a groundbreaking technology, content disarm and reconstruction, or CDR. CDR receives files such as documents and images at the network boundary, recreates the content from scratch, and delivers it clean and sanitized of malware.

Has a cybercriminal hijacked a contractor account and submitted a virus-laden invoice? Has a phishing scammer targeted an agency executive with a ransomware-carrying file attachment? Has a team member unwittingly forwarded an infected slide deck from outside the network perimeter? It doesn’t matter, and there’s no need to even detect the malware. CDR automatically rebuilds the business content of the legitimate file from scratch, and the malware is simply left out. The original content can then be retained in a sandboxed environment or discarded, along with any malware the file might have included.

With CDR, all your users can browse, download, access and share digital content with absolute certainty that any ransomware or other malware threat has been removed. You can apply this content sanitization to any content transiting in, out or around your organization. The process scales and works at cloud speeds, so it needn’t slow productivity and negatively affect user experience.

CDR is even appropriate for organizations that manage highly secure enclaves like the classified networks used by the Defense Department and intelligence community. These organizations can combine CDR with cross-domain protections such as a high-speed verifier for data validation and one-way data transfer. This way, they can meet Raise the Bar guidance by the U.S. National Cross-Domain Strategy and Management Office for connecting to unclassified or high-threat networks.

Today’s cybersecurity risks have changed. New remote and hybrid work models have extended the perimeter, and the real perimeter now is wherever your data is accessed, transmitted and stored. 

At the same time, the threat that incoming and outgoing data can be infected with malware has surged. Antivirus detection can help, but it’s no longer enough to thwart ransomware and other insidious attacks. Today’s agencies need content protections that extend their zero-trust model data—that highly valuable commodity you ultimately need to secure.

Audra Simons is senior director of product management for Global Governments & Critical Infrastructure at Forcepoint.