Capita Suffers Major Ransomware Attack

Last month, UK government contractor and outsourcing firm Capita suffered a ransomware attack by the Black Basta gang.

The cyber-attack resulted in a disruption of essential public services for several days and a significant data breach, including sensitive information of pension providers. Capita has disclosed that the cost of the attack is estimated to be between £15m and £20m.

The specific tactics, techniques, and procedures (TTPs) used by the threat actors in the Capita cyber-attack are currently unknown. However, the Black Basta gang used ransomware to encrypt Capita’s systems and demanded payment in exchange for a decryption key. It is unclear how they gained access to Capita’s systems.

The cyber-attack has potentially exposed the personal data of Capita’s customers, suppliers, and staff, including home addresses and passport images. The Pensions Regulator has reportedly asked hundreds of pension funds that use Capita as an administrator to assess whether their client data may be at risk.

Capita has not disclosed any information regarding potential regulatory penalties that may result from the significant loss of data, some of which reportedly has been circulating on the dark web. Additionally, there was no disclosure about whether or not they have paid any ransom to the Black Basta gang.

Acreto Solution

The Acreto prevents ransomware attacks like the one that impacted Capita by using its ecosystem feature.

An Acreto Ecosystem addresses the ransomware challenge by:

1. Eliminating the Internet attack surface

2. Eliminating the internal attack surface through segmentation

3. Advanced file controls that prevent the download of file types such as .exe, .dll, .msi and .scr used by malware

4. implementing inline SSL/TLS Decrypt

5. Implementing inline threat detection and mitigation for all communications.

Acreto’s Ecosystem can easily isolate individual or groups of systems on a shared network, including hostile networks or the entire network, to limit access only to systems that need to interoperate together. This is done with micro-segmentation, nano-segmentation, and isolated data flows, which ensure that the ransomware attack cannot spread throughout the network.

Ecosystem Security Isolation

Ecosystems deliver a dedicated security infrastructure that can be deployed per application, use-case, project or third-party. An Ecosystem inherently limits access only to users, devices, systems and applications that need to interoperate together.

Ecosystems support any technology, on any network, anywhere in the world. These include computers, mobile devices, IoTs, Offices, Clouds, SaaS and Data Centers.

Ecosystems can be configured as:

Eliminate the Internet Attack Surface

Eliminates any and all access from the Internet while Ecosystem members can interoperate with authorized systems and applications.

Eliminate the Internal Attack Surface

Ecosystems can easily isolate individual or groups of systems on a shared network or entire networks, to limit access only to systems that need to interoperate together. This is done with

Isolated Data Flows

Isolated data flows can be defined between two Ecosystem members to limit access to specified sources and destinations, network protocols and ports, application protocols as well as application programs.

Encrypted Secure Scan

Secure Scan addresses a key weakness in many security tools today. 90%+ of all communications is encrypted, yet only 10% of organizations have the means to secure these communications. Encrypted Secure Scan decrypts, scans, and re-encrypts communications inline and in real-time.

Any malicious content embedded in the encrypted payload is blocked, otherwise the clean and validated communication is delivered to its final destination.

Controls

Threat Prevention

After verification of network protocol, port, application protocol and application program, a deep inspection is performed on all communications. The effectiveness of this method is amplified by inline Encrypted Secure Scan. Threat prevention capabilities utilize two key methods:

Simplicity

Acreto Ecosystems are very easy to provision and deploy. There are no hardware dependencies or associated logistics.

Provisioning an Ecosystem takes 3-5 minutes. Simply provide a unique name to the Ecosystem then choose the bandwidth desired and within a few minutes your Ecosystem providing a dedicated security infrastructure is ready.

Depending on your connection options for Ecosystem members, deployment can take between 10 minutes to a few hours.

Sustainability

Acreto Ecosystems utilize a sustainable model without any dependency on products and their associated logistics. There are no more updates, upgrades or technology refreshes.

Change Management

Different Ecosystems operate completely independently from one another. Therefore, change management impacts only members of a specified Ecosystem, not the entire organization. This simplifies the traditionally complex change management process.

Policy Management

Policy management also benefits from Ecosystems. Because Ecosystems are specific to a customer scenario such as an application, use-case, project or third-party, all policies apply to the scenario. Moreover, when its time for policy cleanup, when an application or use-case is retired, disabling or deleting the Ecosystem automatically prunes the policies. This has traditionally been a complex task that is at best inaccurate.

 

About Acreto

Acreto delivers full-stack cybersecurity without products, logistics or significant security expertise. It creates and consolidates the best of cybersecurity into a single plug-and-play platform with automated updates to stay ahead of threats. Acreto activates enterprise-grade security instantly, so organizations can run safely, easily, and without interruption.