## 4 Results
### NotPetya
Robust defense mechanisms should also trigger immediate alerts to administrators when key DLLs, such as shell32.dll, are exploited, enabling prompt responses to mitigate threats. Figure 17 shows the increasing risk levels at each stage of the NotPetya attack. The stages include document distribution, querying data object properties, creating new data objects, executing/manipulating files, and destroying critical data. Figure 16: Shell32.dll functions utilized by NotPetya malware. Figure 17: NotPetya malware risk level graph. Layered Resilience Strategy for NotPetya Threat Mitigation  
NotPetya is a destructive wiper malware that caused extensive global damage in 2017 by permanently destroying data. To defend against NotPetya's multi-layered threats, this strategy outlines specific objectives, action steps, and resource allocation across key layers. 1. Physical Layer Defense
2. Objective: Prevent unauthorized physical access to critical infrastructure. 3. Action Steps: Enforce physical access controls, including USB port blocking and insider activity monitoring. 4. Resource Allocation: Budget for USB blockers, security personnel training, and real-time access control systems. 5. Risk Management: Establish secondary security checkpoints in restricted zones, regularly review USB and insider monitoring system logs. 6. Evaluation and Improvement: Conduct quarterly assessments of physical control measures and implement ongoing training to reinforce awareness among personnel. 7. Network Layer Defense
8. Objective: Strengthen detection and containment across networked devices to isolate malware and prevent lateral movement. 9. Execution Plan: Regularly patch network software to close vulnerabilities. Segment network areas by sensitivity level to contain malware effectively. Enable real-time monitoring to detect abnormal activity and immediately isolate threats. 10. Risk Management: Implement contingency VLNs and ensure real-time monitoring logs are backed up to support rapid identification of malware movement patterns. 11. Evaluation and Improvement: Regularly review patch management success rates and conduct bi-annual stress tests to validate the real-time containment speed and accuracy. 12. Application Layer Resilience
13. Objective: Proactively strengthen resilience against destructive malware by implementing adaptive defense mechanisms at the application layer. 14. Strategic Approach: Regular software updates and automated patching reduce vulnerabilities, while predictive anomaly detection identifies suspicious activities in real time. 15. Resource Allocation: Allocate funding for advanced patch management systems, designate cybersecurity teams to oversee updates and anomaly detection, and maintain an up-to-date multi-tiered data backup and recovery protocol to minimize data loss. According to Figure 18, at the physical layer, malware can enter the system via external devices such as USB drives or through malicious insiders installing it directly. To prevent this, organizations must enforce physical access controls for critical servers and network infrastructure and implement measures such as USB port blocking and insider monitoring systems to strengthen physical security. At the network layer, NotPetya caused the most damage by exploiting the EternalBlue vulnerability to spread across connected devices. To defend against such attacks, regular security patching is crucial, along with network segmentation to isolate different sections of the network. Additionally, deploying IDS and IPS is essential for real-time monitoring of network traffic and blocking malicious activity. In the application layer, NotPetya exploited vulnerabilities in the software to destroy data. Unlike traditional ransomware, NotPetya's goal was not to encrypt data for ransom but to render it irrecoverable, leading to devastating losses. To protect against this, organizations must ensure regular software updates and implement real-time application monitoring to detect abnormal behavior.