Security Chaos Engineering to Avoid Payments Ramsomware

Presented in Update Conference Krakow 2025

Transcript

1. Security Chaos Engineering to Avoid Payments Ransom Gangs
2. YURY NIÑO Cloud AppMod Engineer Chaos Engineering Advocate @google www.yurynino.dev www.yurynino.dev
3. Agenda Ransomware Intro What are Ransomware Gangs? Why we need Security Reliability? Security Chaos Engineering Intro How to use Security Chaos Engineering to anticipate a ransomware attack? Takeaways
4. Ransomware Introduction
7. No 24% What would you be willing to do to recover a file on which your reputation depends? A survey among 32 colleagues showed that they would not pay for recovering the reputational data. Si 76% www.yurynino.dev
8. What the companies said Ransom payments are required to obtain the keys to decrypt files and to prevent stolen data from being leaked or sold. https://www.hipaajournal.com/ransomware-payments-record-low/ 85% 46% 29%
9. What are the Ransomware Gangs?
10. https://www.coretech.us/blog/ransomware-gangs-what-are-they-how-do-they-operate WHAT are RANSOMWARE GANGS Ransomware Gangs are organized cybercrime groups where each member has clearly defined roles and responsibilities. Here their characteristics: Share victim data and elaked sites Share infrastructure Share & swap tactics Share profits The rise of ransomware cartels In 2021, ransomware groups began forming organized cartels. Alliances like Wizard Spider, Twisted Spider and LockBit formalized it. By 2022, LockBit alone was responsible for 44% of global ransomware incidents Next years prominent cartels have been shut down, new alliances like Scattered Spider and Ransom Hub are still forming and are stronger than ever.
11. https://www.bladetechinc.com/news/5-stages-of-a-ransomware-attack
12. Data from Blackfog showed that from January to November of 2021 year, 244 ransomware hacks were publicized. Hitting sectors like healthcare, education or services. Most of those hacks occurred in the government sector.
13. Why we need Security Reliability?
14. Critical gaps are often in preventing the initial breach and in the confidence and capability to recover without paying the ransom.
15. While traditional security often focuses on preventing known threats, it is not sufficient for complex, dynamic systems and novel attack methods.
16. What is Chaos Engineering? It is the discipline of experimenting failures in production in order to reveal their weakness and to build confidence in their resilience capability. https://principlesofchaos.org/
17. What is Security Chaos Engineering? It is the identification of security control failures through proactive experimentation to build confidence in the system’s ability to defend against malicious conditions in production. Chaos Engineering Book. 2020
18. Hypothesize Identify assumptions about your ransomware defenses Simulate Run safe ransomware-like behaviors using chaos tools Observe Measure detection, alerting, and response quality Improve Patch gaps, adjust controls, enhance playbooks Repeat Make it an ongoing process, not a one-off. HOW TO PREVENT RANSOMWARE ATTACKS WITH SCE
19. A Book about …
20. If ransomware encrypts files on an endpoint, EDR should detect and isolate the machine. Backups should remain untouched even if ransomware hits production systems. 1. Define Hypotheses about Security Controls
21. File encryption simulation using benign scripts to mimic encryption patterns. Mass file access/modification: Simulate rapid file changes to test detection and response. Tools like: [Atomic Red Team, Caldera, Infection Monkey] 2. Simulate Ransomware Behaviors
22. SIEM/EDR/IDS/IPS alerts Automated isolation of endpoints. Backup integrity checks. Incident response time. 3. Test Detection and Response Mechanisms
23. Harden EDR rules. Limit permissions. Improve segmentation to contain ransomware spread. Train incident responders using the test results. 4. Improve Based on Findings
24. Integrate into CI/CD pipelines or periodic testing routines. Evolve attack simulations as ransomware tactics evolve. 5. Automate and Re-Test Continuously
25. Examples CHAOS Experiments SCE Security Chaos Engineering Book
26. Examples CHAOS Experiments SCE Security Chaos Engineering Book
27. Proactive Validation of Recovery is Paramount. Build Muscle Memory and Confidence in Incident Response. Uncover Blind Spots in Security Controls and Monitoring. Reduce Financial and Reputational Risk by Proving Resilience. Takeaways
28. @yurynino How to begin?