Establishing Network Security Best Practices Within Your Organization

Case Study of Successful Network Security Practices

One long-time Scale Computing™ retail client was the victim of a ransomware attack at its headquarters. Ransomware is malware designed to encrypt files on a device, rendering those files and the systems that rely on them unusable. Malicious actors then demand a ransom in exchange for decryption.

While several entry methods are known for ransomware, the client believes this attack began when a user opened a malicious email, which led to the execution of Maze (formerly known as ChaCha) ransomware. The client's network resembled those used by many other small-to-medium-sized organizations: a self-managed, flat topology. As a result, the breached endpoint (an employee's PC) had full network access to all other endpoints. Once the first PC was compromised, the ransomware spread easily through the network. Within a few hours, the ransomware encrypted much of the infrastructure, taking it effectively offline.

The ransomware affected not only file servers but also continued to move both laterally and vertically, encrypting critical files on other end-user desktops and servers. Ultimately, many key internal systems were affected, which impacted the client's daily operations. While the retail locations themselves were not compromised during the ransomware attack, over 300 corporate systems were affected. However, because certain corporate systems went offline, some business processes were disrupted for over 450 retail locations.

Although the client eventually quarantined the affected systems, bringing everything back online was slow and tedious. With limited technical and security resources, the team found it impossible to restore or rebuild all critical systems in a reasonable time period. This left them with reduced visibility into their operations and limited actionable data to guide the business.

Leveraging their existing general-purpose IT vendors proved difficult, as those vendors did not respond quickly, take ownership, or cooperate well with other vendors. The client's next step was to consult an expensive cybersecurity firm to assist with the ransom negotiation and forensics process. The negotiation was unsuccessful, and so the recovery process began.

Soon it was discovered that beyond encrypting critical business data, the ransomware had also exfiltrated information from internal systems. Data exfiltration is common among cybercriminals seeking to extort additional money later. For organizations with personally identifiable or patient medical information, this also creates significant reputation and customer experience risk.

Evidence also surfaced of other malware that had been in the network since 2018, which meant that traditional server restores could not be trusted. After weeks of being resource-constrained and trying to remediate the issues themselves, the client turned to its trusted security partner: our team at Scale Computing.

Our team had provided managed network security services, now delivered through SC//AcuVigil™ Networking, for the client's retail sites for many years. While the client always felt confident in its site security, there had been a lingering question about corporate network security at headquarters. The client had approached us earlier about implementing our suite of services at its corporate offices, but other priorities prevented the project from moving forward. After the breach, however, leadership prioritized cybersecurity much more, and our team was brought in to help.

We reviewed the network topology, interviewed team members, and conducted an exhaustive discovery process to understand the client's challenges and goals. Working with the client's staff and other technical vendors, our team designed a comprehensive recovery, migration, and protection strategy and delivered an implementation timeline for a suite of managed security services for corporate and regional offices. The biggest lesson from this incident is the flat network. Once one PC was compromised, nothing stood between the ransomware and the rest of the corporate systems, which is exactly the gap network segmentation is meant to close.

How SC//AcuVigil Networking Can Help Organizations

SC//AcuVigil Networking is a Scale Computing managed network service for multi-site operators, combining a 24/7 Network Operations Center (NOC) with security, visibility, and compliance tools. Here’s how it supports the practices above:

• Customized Security Strategies: The service is set up around each organization’s sites, devices, and compliance needs, with optional apps added where they’re useful.
• Advanced Threat Detection: Real-time site monitoring and scheduled vulnerability scanning help surface threats early. If ransomware does get in, AcuLock™ quarantine ransomware response can lock down compromised devices while the rest of the site keeps running.
• Expert Guidance: Our team provides guidance and support to help you implement and maintain effective network security measures.
• Security Policy Development: Per-device firewall policies control who and what can connect, while PCI DSS tools like the SAQ Wizard, a network diagram template, and a compliance assistance helpdesk help you document and maintain your own policies.
• Improved Security and Peace of Mind: You can focus on growing your organization while the NOC team monitors and manages the network across every location.
• Firewall and Intrusion Detection: Built-in firewalling and network segmentation protect every site, optional intrusion detection watches the payment network for unusual traffic, and updates to the edge security device are pushed remotely.

Network security is integral to safeguarding your organization's digital assets, reputation, and customer trust. By understanding its importance, implementing best practices, and partnering with trusted experts like Scale Computing, you can build a resilient defense against modern cyber threats.