At Predatar, we’re getting into the spooky season by watching some of our favourite scary movies. Here are five lessons from the original 1996 Scream movie to help you avoid a digital bloodbath.
⚠️ Warning! This blog contains spoilers. But seriously, if you haven’t seen Scream, where have you been for the last 29 years?
Locking the door isn’t enough
Countless times in this classic slasher movie, a door is locked to keep the killer out – but moments later, he’s inside, knife in hand, ready to strike. If you’ve seen Scream, you’ll know how he does it, but that’s not really important here. The point is this:
If someone really wants to get inside, they will.
Cybercriminals are just as determined, creative, and motivated. You might think your IT perimeter is locked down with leading enterprise cybersecurity tools, but the evidence tells us these defences are far from infallible – especially when you consider that over half of ransomware attackers use compromised login credentials to gain access to critical systems.
Hackers don’t hack anymore. They log in.
Lesson #1: Prepare for the breach. You need to know exactly how you’ll respond when the bad guys get in – because we all know that running up the stairs in a panic never ends well.
Anyone can be next
Just as certain industry sectors are at high risk from ransomware attacks, the Ghostface slasher in Scream has a “type”. Most of his victims are teenage girls (and their boyfriends), but there are a few exceptions. Principal Himbry of Woodsboro High School, for example, meets a particularly messy end when he’s stabbed in his office and left hanging from the football goalposts.
Does his murder drive the plot? Not really. But it adds tension, and reminds us that the attacker is calling the shots. He’s unpredictable. Anyone could be next.
When it comes to ransomware, the same is true. While industries such as manufacturing, financial services, healthcare, and utilities are at highest risk, the reality is that any organisation can be hit.
Lesson #2: Don’t be complacent. Face up to the fact that your organisation could be a target.
Attackers do their homework
In the opening (and, in our opinion, the most intense) scene, the phone rings. The sinister voice on the other end walks Casey through a sequence of ‘games’, culminating in the gruesome deaths of her and her boyfriend, Steve. The double murder takes just minutes to play out – but it’s been planned impeccably.
The attacker knows everything about the victim and her home. He knows the floor plan. He knows where the exits and light switches are. He even knows how she’ll react to certain triggers.
Just eleven minutes after Casey first picks up the phone, her disembowelled body is hanging from a tree while her boyfriend sits duct-taped to a deckchair, his vital organs exposed. But here’s the thing, for that attack to run like clockwork, there had to be weeks of surveillance and planning.
That’s the modus operandi for ransomware attackers, too. They conduct detailed reconnaissance before executing a clinical and devastating attack.
In more than 90% of ransomware incidents, surveillance tools such as keyloggers and infostealers have been found inside victims’ systems. If you can catch attackers in this reconnaissance phase, you can stop an attack before it begins.
Lesson #3: Assume you’re already under surveillance. Look for the digital clues of hacker reconnaissance in your IT environment – every day.
The odds are against you
For the masked slasher, each murder is a game – but it’s a game he’s designed himself, so the odds are stacked in his favour. This is best illustrated when he tells Sidney,
“I ask a question… Get it wrong, you die. Get it right, you die.”
All too often, ransomware attacks are lose–lose situations too. Paying the ransom doesn’t guarantee anything. Of the organisations that pay, only 8% get all of their data back.
Worse still, double extortion is now commonplace. Even if you’re “lucky” enough to have your data decrypted after paying a ransom (which typically costs more than $1 million USD), the attackers may deliver a second ransom demand – threatening to publish your sensitive data on the dark web.
But – big spoiler alert –Sidney doesn’t die. She outsmarts the attackers. She refuses to play their game. And you can too.
The best way to survive a ransomware attack is to stop the game before it begins. Thanks to Predatar’s recovery-driven threat detection, you can detect and prevent attacks before they start.
Lesson #4: Think differently. Outsmart the attackers with new and innovative solutions.
Timing is everything
The attacks in Sidney’s and Casey’s homes take place when their parents are out — they’re home alone. Of course, this isn’t a coincidence; it’s an integral part of the killer’s plan.
Ghostface strikes at carefully chosen moments to maximise his chances of success and minimise the risk of intervention.
Cybercriminals do the same. It’s no coincidence that there’s a spike in reported cyberattacks during public holidays, when most organisations are shut down or operating with skeleton staff (Halloween pun not intended).
A rapid response to an active cyberattack dramatically reduces its impact. In a cyber crisis, every minute counts. But when your staff – including IT and security teams – are offline, those response times are significantly extended.
Lesson #5: Act now. The biggest holiday season of the year is just weeks away, but it’s not too late to stop an attack with pre-emptive, recovery-driven threat detection.
Join the next Predatar Webcast – and avoid a digital bloodbath
Join the next Predatar webcast to:
- Hear about a real world use-case where hacker’s surveillance tools were uncovered inside a customer’s storage environment thanks to pre-emptive data validation.
- Discover how automated recovery testing and malware interrogation in a CleanRoom can stop cyberattacks, before damage is done.
- Learn how you can deploy your own Recovery Assurance CleanRoom quickly and easily.
