How to protect your infrastructure from ransomware attacks so you don’t end up like Garmin

You protect your infrastructure from ransomware with several layers of defense: modern security solutions on every computer, isolated backups, two-step verification, up-to-date software and employees who can spot a suspicious email. None of these measures is enough on its own. The 2020 attack on Garmin shows what happens when an attack succeeds.

What happened to Garmin?

On July 23, 2020, Garmin’s internal network was hit by a ransomware attack, as Engadget reported the next day. A few days later, Garmin confirmed that the attack had encrypted some of its systems.

For several days, the website, the apps, the Garmin Connect service and the call centers were down, and users couldn’t sync their devices. Garmin said it had no indication that customer data had been accessed. Without a doubt, an incident like this causes heavy losses, whatever the size of the company affected.

What is ransomware?

Ransomware is a type of virus that encrypts the data it can access and demands a ransom, usually a large one, to recover it. Many gangs steal the data before encrypting it and threaten to publish it if the victim doesn’t pay. Paying doesn’t guarantee you’ll get your data back, and attackers now rent out their tools to other criminals, as a service: we wrote about this in the article on ransomware as a service (RaaS). See also why ransomware can’t be stopped easily.

Which measures protect you from ransomware?

A minimum set of security and prevention solutions will help keep your company from being unable to operate, from losing money and from frustrating its employees, customers and suppliers.

The minimum measures RezolvIT proposes to prevent this kind of situation are the following:

• Modern security solutions on every workstation and server. They stopped being a luxury long ago: a moment of carelessness and a click on an email with a malicious attachment can get the entire company encrypted. Classic antivirus is no longer enough; endpoint detection and response (EDR) solutions watch for suspicious behavior, not just known viruses.
• Isolated backups. Errors can happen, and software vulnerabilities will always exist, but a solid backup policy lets you restore compromised data quickly. Follow the 3-2-1 backup rule, keep at least one offline or immutable copy that ransomware can’t encrypt, and test your restores. A service like Backup as a Service does this automatically.
• Two-step verification on email, the VPN and any remote access. Don’t leave RDP open to the internet.
• Up-to-date software for operating systems, applications and network equipment (firewall, VPN). Many attacks exploit vulnerabilities for which an update already existed.
• A segmented network and minimal access rights. A compromised computer shouldn’t be able to reach all of the company’s servers and data.
• Trained employees who can recognize a phishing email and report anything suspicious right away.
• Cloud solutions used correctly. Cloud solutions can be used securely from anywhere and take part of the burden of on-premises servers off the company, but they also need two-step verification and backup.
• An incident response plan, so that the team knows what to do in the first few hours. See what a security incident response plan looks like.

The solutions above are a minimum, but depending on your budget, much more advanced procedures and processes can be put in place to secure your data. For companies that fall under NIS2 (in Romania, GEO 155/2024), such measures are mandatory, and a significant incident must be reported to DNSC (the Romanian National Cyber Security Directorate) within 24 hours.

RezolvIT has a clear and effective approach to security and offers its clients high-performance backup and network security solutions through its IT security services. If this article has convinced you, request a free IT audit.