But the trick is to keep the ransomware out, which in the case of the incident concerned meant changing the received wisdom. No you can't rely on your AV product to keep it out. You can't rely on your web filtering either, as it's often simply not smart enough. We had to move to weekly patch cycles, as attackers were reverse engineering the patches released by vendors to craft exploits, so actually targeting organisations with a longer patch delay time. So if you go back to your old NIST SP800-40 there's a reason they cite patch delay time as a key metric to capture!
@Steve-WilmeThen what about ensuring your vulnerability management system is directly aligned with what is really going on in the world, and ensuring your patch management regime is prioritised in terms of urgency or criticality?
But the trick is to keep the ransomware out, .... We had to move to weekly patch cycles
Without question, prompt preventative maintenance is important, but it is also important to realize that patching will not protect you from a Zero-day (been there; had to recover a company from one).
One really wants a multi-layered defense strategy that includes both preventative and recovery measures.
@denbesten It would also be a good idea to replace human beings (radical approach) with Robotic Process Automation (RPA) especially in repetitive roles, especially those who do not think or are multi-tasking - talking to their mates on mobile phones etc etc or distracted.
However, a good endpoint prevention regime is also required, with automatic policies to reduce the likelihood of a zero day occurring especially with Augmented Intelligence (AI) to reduce the impact and therefore the resultant cost of compromise.
An here is another gloat of Ransomware attacks in Australia:
Look at the impact on people and hospitals.