BDSLCCI is helping small and medium businesses prevent ransomware attacks | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

India, October 19, 2023: According to India Ransomware Report H1-2022 by CERT-In, on average, there is a 51% increase in ransomware incidents reported compared to 2021, where maximum usage was of double and triple extortion tactics. The majority of the attacks were observed in the datacenters, IT, and ITeS sectors, followed by the manufacturing and finance sectors. Ransomware also targeted critical infrastructure, including the oil and gas, transport, and power industries. While large economies like the United States and the United Kingdom saw a decrease in ransomware assaults, India (up 133%) and Germany (52%) were among the nations that saw a significant increase in such attacks, according to the 2023 SonicWall Mid-Year Cyber Threat Report for the January-June period. According to IBM’s “Cost of a Data Breach 2022” research, the average ransom payment is $812,360. However, the actual ransom payment is only a portion of the total cost of a ransomware assault, which IBM estimates to be $4.5 million on average. As per Sophos, the average ransom in 2023 will be $1.54 million, nearly quadrupling the number of $812,380 in 2022.

The inventor of BDSLCCI, Dr. Shekhar Pawar, found that businesses that undergo such cyberattacks face various problems, such as financial loss, data loss, the spread of malware, market reputation damage, production halts, and so many other legal and regulatory consequences. When it comes to SMBs or SMEs, most of the time these organizations do not have enough financial budget to implement generic cybersecurity standards available in the market, lagging cybersecurity knowledge among teammates, and not a visible “return on investment (RoI)” for the resources utilized in cybersecurity implementation and maintenance. The business domain-specific least cybersecurity controls implementation (BDSLCCI) framework is now able to resolve these problems for SMBs or SMEs by providing “tailored” cybersecurity controls based on the business domain of the organization, thereby “reducing the cost” of cybersecurity implementation by more than five times the cost of existing standards and providing many useful tools that are “free” to use. Also, as it is in alignment with the business goals of the SMB or SME, it helps top management see the RoI. BDSLCCI works on two cybersecurity aspects: defense in depth (DiD) and mission critical assets (MCA).

Companies need to strengthen BDSLCCI’s recommended DiD

“Ransomware attacks have a long chain of extortion for their victims, making it very difficult to trust the threat actor sitting in a hidden place. Hence, prevention is better than cure, which is very true in the case of ransomware. Business Domain Specific Least Cybersecurity Controls Implementation (BDSLCCI) provides tailored cybersecurity controls with reduced cost and fewer resources to adopt preventive measures against ransomware and similar cyber threats,” says Dr. Shekhar Pawar, Founder of SecureClaw Inc.

Types of extortion by ransomware attacks:

The most popular cyberattack in various industries is ransomware, which has a long chain of extortion techniques for its victims. Like there is innovation in various technical domains, the ransomware attack methodologies have advanced with time. When ransomware first appeared, it was a malicious program that encrypts files or systems and stops users from accessing them. The files, or even entire devices, are then encrypted and held hostage until the victim pays a ransom in exchange for a decryption key. The key allows the user to access the encrypted files or systems of the software. It was known as a single-extortion attack. WannaCry and CryptoLocker are a few examples of single-extortion ransomware attacks. After that, cybercriminals started a new technique to gain more ransom from their victims, which can be called double extortion. In cases of single extortion, many organizations overcome the threat of file encryption with a simple, up-to-date backup system. Cybercriminals started stealing sensitive information from organizations and threatening to leak it or sell it to the public, mostly via dark web leak sites or the black market. In such cases, even if victims manage to pay a ransom to get a decryption key or restore backup data, they will still be asked to pay another ransom to avoid their stolen data being sold or distributed publicly. Maze and DoppelPaymer are a couple of examples of such double extortion tactics. Going ahead, after double extortion attack tricks, triple extortion attacks started taking place in various forms. In addition to two techniques to harass victim organizations that had already undergone ransomware attacks, cybercriminals started one more threatening one where they might use a service disruption attack to exert additional pressure. AvosLocker is one of the ransomware variants that employs denial-of-service (DDoS) assaults as part of its triple extortion practice. Going beyond triple extortion, cybercriminals can even potentially increase their profits by using quadruple extortion ransomware, frequently involving contacting third-party associates with ransom demands or other unethical measures.

Another strategy used by the DarkSide ransomware gang is to threaten publicly listed firms by providing short stock opportunities to unethical traders. In this form of attack, the gang threatens to publicly reveal the identity of the victim organization, perhaps causing the stock price to decrease. A trader with firsthand knowledge of the attack may benefit handsomely.

The BDSLCCI framework helps to prevent ransomware in SMBs or SMEs:

It is highly recommended to implement preventive measures as well as not pay ransom to threat actors. Especially for preventing ransomware attacks, it is important to protect data and systems. Companies need to strengthen BDSLCCI’s recommended DiD, which is a combination of the data security layer, application security layer, host or endpoint security layer, network security layer, physical perimeter security layer, human security layer, and overall organization’s security governance. Also, BDSLCCI focuses on securing MCAs against disclosure, alteration, or disruption. BDSLCCCI has MCA-specific recommended controls for more than 50 business domains, such as e-commerce, e-learning, pharmaceuticals, institutes (schools and colleges), manufacturing, IT consulting, healthcare, chemicals, etc.

According to the various latest cyber threat statistics, ransomware attacks are mostly executed via social engineering, RDP vulnerabilities, unpatched software, password guessing, credential theft, remote server attacks, third parties, and USB drives. Along with various other cyber threats, BDSLCCI’s DiD controls are mapped to lower the risks of ransomware attacks. Various cybersecurity controls in layers contribute to the same. Apart from that, MCA is being protected more with additional controls. Hence, for a long time, BDSLCCI has been able to protect SMBs or SMEs against ransomware and other cyber threats. Knowledge of BDSLCCI is also available as a book on Amazon, Kobo, and other platforms.

To sign up for BDSLCCI, visit

Email: [email protected]

Contact: (+91) 882-821-2157 or +1 (218) 718-2121

Disclaimer: This article is a paid publication and does not have journalistic/editorial involvement of Hindustan Times. Hindustan Times does not endorse/subscribe to the content(s) of the article/advertisement and/or view(s) expressed herein. Hindustan Times shall not in any manner, be responsible and/or liable in any manner whatsoever for all that is stated in the article and/or also with regard to the view(s), opinion(s), announcement(s), declaration(s), affirmation(s) etc., stated/featured in the same.

Exciting news! Hindustan Times is now on WhatsApp Channels Subscribe today by clicking the link and stay updated with the latest news! Click here!


Click Here For The Original Source.

National Cyber Security