Ransomware Classification and Defensive Strategies

Kriptovirusi predstavljaju posebnu vrstu malicioznih programa čiji je cilj kriptiranje privatnih podataka sa svrhom iznude vlasnika tih podataka. U interesu očuvanja svojstava povjerljivosti, cjelovitosti i raspoloživosti informacija, cilj ovog rada bio je razraditi klasifikaciju kriptovirusa i utvrditi procedure, kao i defenzivne strategije kojima bi se nastojala umanjiti šteta nanesena njihovom prijetnjom i djelovanjem. Kombinacijom kvalitativnog i kvantitativnog istraživanja, problematika kriptovirusa metodološki je analizirana kako bi se utvrdio teorijski okvir za razumijevanje njihovog djelovanja. Pregledom povijesnog razvoja kriptovirusa dobiven je detaljan prikaz toka njihovog nastajanja i razvitka u prijetnju koju predstavljaju danas. Razradom klasifikacije kriptovirusa stvoren je pregled karakteristika zajedničkih svim obiteljima i verzijama kriptovirusa i njihovih mehanizama, a utvrđene su i njihove najčešće mete. Grafičkim prikazom anatomije kriptovirusa kroz faze je prikazano njihovo djelovanje čime su utvrđeni svi koraci koje maliciozni softver mora proći kako bi otuđio podatke od korisnika. Analizom presjeka kriptovirusa dobivene su konkretne procedure za preventivne radnje, kao i za postupanje pri napadu kriptovirusa i očuvanju podataka. Metodom testiranja, kroz brojne scenarije napada kriptovirusa, testirani su odabrani alati koji koriste različite pristupe u očuvanju sigurnosti sustava. Premda su neki od tih alata pokazali dobre performanse, zbog karakteristika djelovanja kriptovirusa, to još uvijek ne jamči potpunu sigurnost sustava. Za sva daljnja istraživanja, bitno je napomenuti kako zbog brzine kojom novije verzije kriptovirusa postaju sve sofisticiranije, stručnjacima za sigurnosna rješenja postaje sve teže razviti sveobuhvatnu zaštitu od potencijalnih napada, čime sigurnosne mjere i dobre prakse postaju glavne metode u obrani od kriptovirusa.Ransomware is a special type of malware designed to encrypt private data with the purpose of extorting the owner of that data. In order to preserve the properties of confidentiality, integrity and availability of information, the aim of this paper was to elaborate the classification of ransomware and to establish procedures as well as defensive strategies that would seek to reduce the damage caused by their threat and action. An overview of the historical development of ransomware has provided a detailed account of the course of their emergence and development into the threat they present today. The classification of ransomware has created an overview of characteristics common to all families and versions of ransomware and their mechanisms, and identified their most common targets. By graphically presenting the anatomy of ransomware through phases of its attacks, all the steps that malicious software must take to alienate data from its users were identified. The analysis of ransomware anatomy has provided specific procedures for preventive actions, as well as for handling ransomware attacks and preserving data. By testing numerous scenarios of ransomware attacks, various tools with different approaches in maintaining the security of the system were tested. Although some of the tested tools have yielded good results during testing, due to the performance characteristics of ransomware, this does not guarantee complete system security. For any further research, it is important to note that due to the rate at which more recent versions of ransomware are becoming more sophisticated, security system professionals are finding it increasingly difficult to develop comprehensive protection against potential attacks, making security measures and good practices the main methods of defense against ransomware