Explained | Are ransomware attacks increasing in India?

The story so far: On November 23, e-services at the All-India Institute of Medical Sciences were crippled by what is being suspected to be a ransomware attack. The Delhi Police’s Intelligence Fusion & Strategic Operations have registered a case and launched investigations to identify the perpetrators, while cyber security experts are employing software tools for data recovery. Set up in 2004, the Indian Computer Emergency Response Team is the national nodal agency that collects, analyses and circulates inputs on cyber-attacks; issues guidelines, advisories for preventive measures, forecasts and issues alerts; and takes measures to handle any significant cyber security event. The National Cyber Security Coordinator, under the National Security Council Secretariat, coordinates with different agencies at the national level on cybersecurity issues, while the National Critical Information Infrastructure Protection Centre has been set up for the protection of national critical information infrastructure. Maintain regularly offline data backups — the backup data needs to be encrypted, immutable and should cover the entire organisation’s data infrastructure; regularly check data and code/scripts integrity; all accounts should have strong and unique passwords; have an account lockout policy; multi-factor authentication for all services to the extent possible; have separate administrative network from business processes with physical controls and Virtual Local Area Networks, no unnecessary access to administrative shares; a host-based firewall should be installed to only allow connections to such shares via server message block from a limited set of administrator machines; disable remote desktop connections; have the least-privileged accounts for remote desktop usage; have a proper Remote Desktop Protocol logging and configuration, and spam-proof email validation system; anti-virus software should be updated; users must not open attachments or URL links in unsolicited e-mails and use secure web browsers, etc.