CISA Recommends SMB over QUIC

Ransomware, a Tangible Threat

Ransomware continues to loom as a significant threat to businesses worldwide, causing disruptions and financial losses. To combat this menace, the Cybersecurity and Infrastructure Security Agency (CISA) has released the Stop Ransomware Guide, in collaboration with experts from Microsoft, including Ned Pyle, Principal Program Manager in the Core OS engineering group. This comprehensive guide offers a multitude of strategies to fortify defenses against ransomware attacks, including crucial recommendations regarding the Server Message Block (SMB) protocol.

SMB, a cornerstone of file sharing in Windows environments, has been exploited in its earliest version SMB1 by malicious actors as a conduit for ransomware propagation. However, by upgrading to version SMB3 and above, and by adhering to the best practices outlined in the Stop Ransomware Guide, organizations can protect their digital assets and prevent such attacks. Let’s delve into one of the notable recommendations put forth by CISA: employing SMB over QUIC.

Why SMB over QUIC

SMB over QUIC represents a paradigm shift in secure connectivity to file servers, especially over untrusted networks like the Internet. Here’s why it’s gaining traction as a recommended practice:

1. Enhanced Security: SMB over QUIC ensures that all packets are TLS 1.3 encrypted, with certificate authentication, over UDP port 443. This fortified security layer shields against eavesdropping and man-in-the-middle attacks, mitigating the risk of data interception during transit.
2. Improved Performance: Leveraging QUIC’s advanced congestion control and loss recovery mechanisms, SMB over QUIC delivers superior performance compared to traditional TCP-based connections. This translates to faster file transfers and a smoother user experience, even in bandwidth-constrained or high-latency environments.
3. Resilience to Network Changes: Unlike TCP, which necessitates re-establishing connections upon IP address or port changes, QUIC maintains session continuity seamlessly. This resilience is invaluable for mobile users, telecommuters, and organizations with dynamic network infrastructures, ensuring uninterrupted access to critical files and resources.

Safe SMB Driver over the QUIC Highway

By embracing SMB over QUIC, organizations can bolster their ransomware defenses while facilitating secure and efficient file sharing across disparate networks. Windows Server 2025 introduced SMB over QUIC support, previously exclusive to Azure environments. However, adopting this technology requires expertise in SMB protocol implementation and adherence to CISA’s recommendations.

Introducing Visuality Systems: the preferred partner for SMB protocol proficiency and seamless integration of versatile SMB software libraries into any IT environment. With Visuality Systems’ solutions, organizations can adopt SMB over QUIC into their existing infrastructures, ensuring compatibility with Microsoft’s SMB roadmap. By entrusting their SMB needs to Visuality Systems, businesses can fortify their defenses against ransomware while unlocking the full potential of secure file-sharing in today’s digital landscape.

In conclusion, as ransomware threats continue to evolve, it’s imperative for organizations to maintain a forward-thinking approach by adopting robust security measures. SMB over QUIC emerges as a compelling solution, offering a blend of security, performance, and resilience that aligns with CISA’s vision against ransomware. Partnering with industry leaders like Visuality Systems empowers organizations to navigate this technological landscape with confidence, safeguarding their assets and operations against the ever-present specter of cyber threats.