{"id":73859,"date":"2018-04-27T05:00:19","date_gmt":"2018-04-27T12:00:19","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=73859"},"modified":"2019-01-29T13:17:03","modified_gmt":"2019-01-29T21:17:03","slug":"10-things-test-future-ngfw-prevent-successful-ransomware-attacks","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2018\/04\/10-things-test-future-ngfw-prevent-successful-ransomware-attacks\/","title":{"rendered":"10 Things To Test In Your Future NGFW: Prevent Successful Ransomware Attacks"},"content":{"rendered":"

This post is part of a blog series <\/em>where we dissect the ten things to test in your future next-generation firewall. These ten points will help ensure your next firewall matches the needs of your organization in its current and future states. <\/em><\/p>\n

A successful ransomware attack not only forces organizations to pay to regain access to the encrypted data but also incurs costs from lost opportunities or customers, equipment replacement, new security technologies, damaged reputations, and so on. To address the ransomware problem, most security vendors have updated their security architecture by tacking on ransomware prevention features to existing products.<\/p>\n

 <\/p>\n

Why Should You Advocate and Test This Capability?<\/span><\/p>\n

No single security product can successfully prevent ransomware on its own. As there are multiple stages in the attack lifecycle, there should be multiple layers of defense to prevent ransomware attacks. Your organization\u2019s ability to effectively protect against ransomware is reliant on the natively engineered automation and integration of your security products to proactively detect and prevent ransomware. A multilayered defense is the most effective way to disrupt possible ransomware attacks, and new additions to the security architecture should complement protections throughout the network.<\/p>\n

 <\/p>\n

Move Beyond the Status Quo<\/span><\/p>\n

 <\/p>\n

There Is No Silver Bullet<\/strong><\/p>\n

Protecting against ransomware requires visibility into network traffic and enforcement of applications, as well as user- and content-based policies. It also requires security products to protect against known and unknown exploits, malware, and command-and-control traffic, as well as prevent access to known malicious and phishing URLs.<\/p>\n

 <\/p>\n

Ransomware Is Time-Sensitive<\/strong><\/p>\n

Automation is the only way for prevention capabilities to move more quickly than a ransomware attack can transition through its full attack lifecycle within your organization. To identify and block unknown threats, malicious files and URLs must be detonated, analyzed and observed for malicious activity. Once a file or URL is identified as malicious, protections must be created and automatically distributed throughout the security infrastructure \u2013 across the network, cloud and endpoint. This ensures all points of entry are informed and capable of protecting against the latest version of the ransomware.<\/p>\n

 <\/p>\n

Combine Preventive Efforts<\/strong><\/p>\n

For effective prevention, you must employ automation and share information among various security tools that work together to identify known and unknown malware and exploits in your environment, and subsequently identify and quarantine any infected host, preventing the attack from spreading.<\/p>\n

Threat intelligence should always be a component of your organization\u2019s threat prevention efforts, and your firewall should be capable of dynamically updating preventions against malicious IPs, domains and URLs based on information gathered threat intelligence and IoCs.<\/p>\n

 <\/p>\n

Recommended RFP Questions<\/span><\/p>\n

\n