In new guidance released last week, the New York State Department of Financial Services identified cybersecurity controls that the agency says “significantly reduce the risk of ransomware attacks and should be implemented by companies wherever possible.”

Ransomware incidents have increased in “frequency, scope and sophistication,” with the reported rate of ransomware attacks increasing 300% in 2020, according to DFS.

DFS examined ransomware incidents reported by its regulated entities over the past year and a half and observed that they follow a similar pattern: hackers enter a victim’s network, obtain administrator privileges once inside and then use those elevated privileges to deploy ransomware, avoid security controls, steal data and disable backups.

DFS urges all regulated entities to prepare for a ransomware attack by implementing measures including:

• training employees in cybersecurity awareness and anti-phishing;
• implementing a vulnerability and patch management program;
• using multi-factor authentication and strong passwords;
• employing privileged access management to safeguard credentials for privileged accounts;
• using monitoring and response to detect and contain intruders;
• segregating and testing backups to ensure that critical systems can be restored in the face of an attack; and
• having a ransomware-specific incident-response plan that is tested by senior leadership

Credit unions can access the guidance on the DFS website.