Episode 478: Satish Mohan on Network Segmentation

Kill Switch

The concept of a "ransomware kill switch" is akin to an emergency shutdown mechanism for networks. Satish Mohan explains that it operates through a color-coded system, allowing enterprises to adjust security levels from green to red, depending on the threat level 1. This system enables a controlled response to potential ransomware threats without disrupting essential business functions.

Just by flipping the switch, you change the state of the network, what is reachable and what is not reachable.

--- Satish Mohan

This approach contrasts with the traditional panic-driven method of physically disconnecting systems, offering a more sophisticated and automated solution 2.

   

Backup Role

Offline backups play a crucial role in defending against ransomware attacks. Satish Mohan highlights that while they are essential, they are not foolproof due to tactics like double and triple extortion, where attackers threaten to release sensitive data 3. This underscores the need for comprehensive prevention strategies beyond just backups.

You might use an offline backup to recover your data, but it still doesn't prevent the attackers from releasing sensitive data onto the public domain.

--- Satish Mohan

Thus, preventing attacks from occurring in the first place is paramount to safeguarding sensitive information 2.

   

Prevention

Prevention tactics against ransomware include isolation and micro-segmentation techniques. Satish Mohan discusses how AirGap's security appliance can quarantine suspicious devices by creating a virtual ring fence, preventing unauthorized data flow 4. This proactive approach helps in identifying and isolating potential threats before they can spread across the network.

We place like a virtual ring fence around your device... to make sure that no traffic can go in and out of your device unless inspected and authorized by AirGap.

--- Satish Mohan

Regular vulnerability scanning is also recommended to maintain robust security hygiene and detect vulnerabilities early 5.