How iSecurity Protects IBMi from Ransomware

What is iSecurity Anti-Ransomware?

Ransomware can be defined as a malicious program that generally originates from a hacked PC device and contains the victim’s files using a public key generated from another computer. That key is used to decrypt the encrypted files, and hackers demand money from the original data owner and release the ticket after a hefty amount is paid to them. iSecurity anti-ransomware is a program that protects IBM AS400 files and objects against a ransomware attack.

Features of iSecurity Anti-Ransomware

• The program identifies the Ransomware, and delay/stops it in real-time.
• The IBM iSecurity can also detect unknown Ransomware as per other indications.
• IBM AS/400 iSecurity program also incorporates malware honeypots to distract/delay the Ransomware from entering original company objects.
• Accurate and fast detection of Ransomware.
• Classifies the danger that specific Ransomware is carrying and suggests the appropriate way to neutralize that danger according to the situation.
• The iSecurity anti-ransomware also identifies the behavioral impact of malware on different objects and files.
• IBM AS400 iSecurity programdisconnects the intruder and send email alerts to 3 SIEMS in CEF/LEEF format.

How IBM iSecurity Anti-Ransomware Works?

A user switches on his/her PC and maps his device with the IFS files. In the process, the user clicks on an anonymous mail that contains malware, and this email triggers a ransomware program on the PC. The virus starts encrypting the files on the PC as well as the mapped device. iSecurity anti-ransomware from IBM AS400 can identify such files and respond to them in three ways:

Stop the Attack:

The iSecurity anti-ransomware program detects and disconnects the connection between the infected system and IFS files. It also blocks the IP address and stops the attack immediately. Due to blocked IP addresses, malware will not be able to map the network drive, and they will be removed easily with the help of IBM iSecurity.

Alert Responders:

IBM AS/400 The iSecurity anti-ransomware sends instant alerts to all the designated responders, informing them about the attack. These alerts are sent using emails or messages to the system operator console (QSYSOPR).

Perform Additional Actions:

The anti-ransomware program can automatically shut down the PC (generating the ransomware attack).

Ransomware files are updated regularly, and IBM AS400 iSecurity program scan the latest version of the ransomware release. The software has a unique matching algorithm designed to detect the zero-day ransomware releases for new ransomware codes that are yet to be identified.
iSecurity anti-ransomware allows organizations to exclude IFS objects from their scanning, producing false results or that are not accessible.

The IBM AS400 iSecurity program also includes attack simulator software that allows organizations to obtain details about their IFS setup. Information about any real attack can be saved in a log file. Furthermore, these details can be used to setup iSecurity anti-ransomware for triggering actions.

How to Detect a Ransomware?

There is an old saying – “If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck.”

The same pattern is used to detect Ransomware if it is attacking an IFS file. IBM iSecurity anti-ransomware uses different methods of detecting and stopping an attack.

• Continually run IBM AS400 ransomware detection servers that scan IFS folders and files when an IFS object is changed.
• In your IBM AS400, you can look for a specific order of activities linked with the malware. If your servers are showing suspicious behavior, like files are copied multiple times and the original file is deleted, this can indicate that ransomware has hit your system.
• iSecurity program also checks for IFS extension (looking for matches) in IBM AS400 listed in ransomware signature files.
• The iSecurity AR check for unusual changes in IFS files.
• The iSecurity anti-ransomware search for the virus’s unknown variants as per the indicator’s codes in the iSecurity algorithm.
• iSecurity AR can monitor files in IFS unknown source folders and look for ransomware modifications. The folder is loaded with so many files that look important but are worthless. Such folders are the first PoC before interacting with any other file folder and provide the time to iSecurity AR program to react. Due to this time gap provided by the honeypot, i.e., unknown source folder, iSecurity can stop the attack before it damages the entire production line.
• The iSecurity anti-ransomware program also includes an object integrity control method to check if your IBM AS400 license internal code (LIC) has been damaged or not. This method also runs an IBM AS400 API check as part of its routine scanning process.

Infected with Ransomware? Here are the Choices you Have

• • Pay the Attacker: This is the first option you have. But even after paying to the attacker, chances of getting the decryption key are less, or you may receive a resolution that is not working, or you may receive a ticket that stores a different virus program.

According to the Cyberthreat defense report of 2019 by Cyberedge group – “45% of ransomware victims end up paying the money to the attackers, but only 75% of them were able to recover the data successfully.”

• You can choose to restore an encrypted IFS file on your IBM AS400, and it should be from the latest backup. This solution is a little bit time-consuming, and you may lose any new change in the IFS file that occurred in the last backup.
• Install the iSecurity Anti-Ransomware program in your IBM AS/400 platform and stop the ransomware attack before it hit your software. The Anti-ransomware program can control and prevent the damage from an attack in real-time. In case of minor damage, it can be managed by a honeypot strategy.

Integrative Systems can Help you Win the War Against Malware

iSecurity anti-ransomware in IBM AS400 is a vital software program for an organization having exposure to IFS via window mapped drives. At Integrative Systems, we offer services to protect your IFS files from external attacks that occurred by exposure to Windows PCs. The software will be a valuable addition to the fleet, where advanced threat protection is necessary.
For more information, feel free to connect with us at [email protected] or may give us a call on 1.866.468.7974 (INTSYSI).