The attack has spanned one dozen countries and is perhaps the largest ransomware attack on record.
REvil, a ransomware gang believed to reside in Eastern Europe or Russia, attacked software provider, Kaseya, which is the engine used by many Managed Service Providers (MSPs) for network monitoring, patch management, and related services.
If your bank has “outsourced” its network, Kaseya could be the software that is being used to connect the MSP to your bank’s network. Kaseya agents could be installed on your workstations.
The Kaseya VSA (Virtual System Administrator) solution was targeted and was the system used by REvil to install the ransomware.
The hacking group said it infected more than one million systems. The hackers are demanding $70 million in bitcoin to unlock the infected systems, and they say that all companies can de-encrypt at the same time if paid.
Questions for your outsourced network provider:
A. Questions to ask now:
- Do you use Kaseya?
- Is Kaseya installed on our bank’s workstations or servers? If yes, should we disable or uninstall the Kaseya agents on our workstations and servers?
- What is your solution to this problem? Must you now wait on a patch from Kaseya to resume operations and function normally?
- How long will our systems be down?
- Why did your security measures fail to recognize the threat and shut it down?
B. Follow-up Questions:
- If you use Kaseya, what is your alternate system?
- What is the benefit to the bank of using Kaseya?
- Is your company dependent on Kaseya for this service? If yes, do you have a backup plan or a contingency vendor?
- Please send us the latest audit reports you’ve received on Kaseya and their cybersecurity preparedness.
- In this case, did Kaseya serve as a conduit for hackers to infiltrate your company and, in turn, our bank?
C. Long-term Strategic Questions:
- Does our bank have adequate ransomware insurance coverage that includes paying a ransom if that is the only choice we have?
- Does the outsourcing of our network present more risk than we anticipated?
- How are we testing our outsourced network providers?
- Have we held our outsourced providers to high standards, or have we just taken the word of salespeople that all is okay?
- What applications should be on-premises/in-house and which should be off-premises/outsourced?
- What does our contract with our MSP say about breaches and how we remediate these events?
- Are the services provided by our MSP critical, or can we better handle these services in-house?
Unless you have outsourced your network, it is unlikely that you are using Kaseya, but it would still be a good idea to have this discussion with your IT staff and your network support to determine your bank’s exposure.
Many bankers outsource their networks under the false assumption that they will not have to worry about cybersecurity threats or disaster recovery. Both assumptions have always been wrong, and this incident further illustrates that fact. Despite how these services are sold, outsourcing any component of your bank’s technology infrastructure or applications carries risk. Such risk should be assessed on an ongoing basis to promote awareness and to implement risk mitigation measures.
Again, this is a fluid situation so you should contact your provider(s) to get updates and guidance as this incident is contained, controlled, and assessed further.
