AI and how to defend against ransomware

Cyber threats are an ever-evolving problem, so it's absolutely critical to stay one step ahead. Today, defending against these threats isn't a question of "if" but "how".

Cyber threats are an ever-evolving problem, so it's absolutely critical to stay one step ahead. Today, defending against these threats isn't a question of "if" but "how". In today's article we'll look at two segments that are — and will continue to be — a problem.

The rise of AI and machine learning

Concepts like artificial intelligence (AI) and machine learning (ML) used to feel unimaginable, almost dystopian. Today we take them as a given, so it's important to use their potential in cybersecurity too. How can we use them?

·         Threat detection — AI and ML algorithms are excellent at detecting anomalies and potential threats in real time.

·         Predictive analytics — AI can find the weakest point in your network with reasonable accuracy, which is both good news and bad news. It depends on who's using the AI.

·         Automated protection — AI can automatically block or quarantine an infected part of a system or network, drastically reducing the damage an attacker does. It needs to be said, though, that this is prohibitively expensive today; hopefully in a few years these products will reach the wider public.

Ransomware

Ransomware is malicious software that encrypts your data and demands a ransom (decryption key). How do you defend against it?

·         Back up — if at all possible, all important data. Use the 3-2-1 method: 3 copies, on 2 devices, with at least 1 in a different physical location.

·         Phishing — teach yourself and your staff to recognize phishing. Phishing is the main and easiest path attackers take into your network.

·         Passwords and MFA — use unique, strong passwords and multi-factor authentication wherever possible.

Ransomware is here, and probably will be for a long time. This type of attack is absolutely devastating to any company for two reasons:

1.      Access to data — without backups, your access to data is completely cut off, which immediately halts everything in your business.

2.      The ransom — attackers will demand a ransom for decryption, which for smaller companies runs into the hundreds of thousands of crowns and can be absolutely devastating.