Ransomware is on the rise
All businesses need a comprehensive cybersecurity strategy in place to protect themselves, and one of the main things they should be concerned about is ransomware.
In 2019, these kinds of attacks on businesses rose by 41% and 205,000 businesses lost access to important files. Ransomware attacks on businesses can be incredibly costly and it's a mistake to think that cybercriminals only go after big corporations. Any business, no matter how large, can be targeted by these attacks. In fact, small to medium companies are often prime targets because they don't invest as much in cybersecurity and there are more weaknesses in their systems, meaning that it's easier to launch a successful ransomware attack.
Ransomware prevention should be a central part of your information security strategy but, unfortunately, many small business owners don't understand the dangers or how to protect themselves. This article will tell you everything you need to know about what ransomware is, how it works, why your business is likely to be targeted, and how you can protect yourself.
What Is Ransomware?
Ransomware is a type of malware that cybercriminals use to steal your data. They do this by encrypting it so it can't be accessed. If you try to open an infected file on your computer, all you'll see on the screen is gibberish or a message telling you what you need to do if you want to decrypt the file and get access back again.
Once they have gained access to your system and managed to lock certain important files, cybercriminals can then make demands (usually for cash), hence the name ransomware.
How Does Ransomware Work?
The way ransomware works varies slightly between different variants of ransomware but there are some general trends about how these kinds of attacks work.
Ransomware usually gets onto your system using phishing emails which make it look like they've been sent from a reputable company. Your employees are often the ones who are targeted in these kinds of attacks because cybercriminals know that they are more likely to open emails sent from companies they are familiar with. For example, an attacker might send an email pretending to be from your bank that warns you that your password has been compromised and includes a link to download a new one. Once someone clicks on this link, ransomware is automatically downloaded onto their computer and begins its encryption process.
Some strains of ransomware can also get onto your system by infecting other files on removable drives which you then bring into the office and connect to your network. Again, all it takes is for one person to open an infected file and the ransomware will start encrypting data using different keys so no one can access it. And once you're infected, people will only be able to access the files if you pay up and get the decryption key.
The files are locked using asymmetric encryption. This is where two keys are generated to encrypt the file. One key is used to lock the data (called the public key) and one key (the private key) is used to decrypt it again. The private key isn't stored anywhere on your system so you cannot access that information either unless you pay for it or try to crack the encryption yourself, which with modern cryptography is nearly impossible.
Some ransomware can exploit weaknesses in the system and spread itself throughout an entire network to lock multiple files at once. This means that you'll have a much harder time locking down the system and removing it from your infrastructure. It only takes a matter of minutes for ransomware to bring down an entire business.
In most cases, the criminals will then contact the business and demand a ransom within the next few days or the files will be lost forever. It's vital that you have the right cybersecurity measures in place to prevent ransomware attacks because they can be devastating to your business. Paying the ransom means losing a lot of money but if you refuse and the files are lost, you have to manage the extensive costs of data loss. The average cost of a ransomware attack in 2021 is $1.85 million dollars (Source: Sophos.) If sensitive customer information is lost in the attack, this can have a long-term impact on your company because people will quickly lose trust in you.
Why Are Businesses Targeted With Ransomware Attacks?
Businesses are often targeted because cybercriminals know that these kinds of attacks can make them a lot of money. For example, in 2017, The WannaCry ransomware attack affected more than 200,000 people. This included customers who had no access to their files or couldn't use critical systems in hospitals or at manufacturing plants. If you run a hospital, the loss of patient records due to ransomware would have been catastrophic so it's understandable why they chose to pay up when faced with this scenario. The criminals behind these attacks are often located in countries where law enforcement doesn't have much control over cybercrime activities so it can be very difficult for them to catch the attackers. This means that small businesses are less likely to get their files back even if they do pay up because paying won't guarantee anything.
Why Are Ransomware Attacks On The Rise?
Cybercriminals are increasingly using ransomware for several reasons.
- Forcing businesses to pay up quickly before employees lose access to critical systems and files is always going to be an effective way of making money. If they can make over $1 million within a week, the criminals are likely to carry out another attack in the future because they've proven that it's very lucrative.
- The healthcare industry is particularly vulnerable because patient records are extremely valuable on the dark web so criminals will target this area first when looking for quick money. At least five HIPAA-covered entities have been hit with ransomware so far in 2021, there have also been cases where local clinics have paid up after being targeted by hackers. (Source: HIPAA Journal) Cybercriminals know HIPAA-covered entities will be reluctant to admit a security breach so they know it's easy to get away with extorting medical facilities. However, businesses of all kinds are at risk.
- Ransomware attacks are also becoming more sophisticated and widespread because criminals have better technology at their disposal. They've been using efficient malicious spam emails, exploit kits, crypto-mining malware, and crypters to make sure infections spread quickly. The best way to protect against ransomware is therefore by preparing for what could happen in advance.
With ransomware attacks on the rise, it's more important than ever for businesses to find ways to protect themselves.
What Steps Can You Take To Protect Yourself Against Ransomware Attacks?
If you want to protect your business, you need to invest in cybersecurity and put a clear information security strategy in place, and that includes protecting against ransomware attacks. These attacks can be devastating to your business, but there are some steps you can take to prevent them.
Develop A Clear Incident Response And Recovery Plan
If you wait until a ransomware attack happens before you start thinking about how to deal with it, it's already too late. A fast response can limit the damage caused and help to maintain your cybersecurity in the event of an attack. It also helps you recover data and get your business up and running again much sooner. So, you need a clear response and recovery plan in place for ransomware attacks.
You should create an information security plan that clearly outlines lines of communication and roles amongst your IT team, so everybody knows exactly what they are doing as soon as an attack happens.
Creating policies for dealing with suspicious emails is crucial too. If employees are unsure what they should do, they are more likely to click a malicious link. But if there is a clear policy for forwarding it on to the IT team and checking for any potential cybersecurity issues, the risk of ransomware attacks drops considerably.
It's all about being prepared for any eventuality and knowing exactly how to respond before it has even happened.
Create Regular Data Backups
If your business suffers from a ransomware attack, having regular backups of your data can make a huge difference. This is why you should always have more than one backup of your files and store these backups in separate locations. Regular backups help you recover quickly after any kind of cyberattack while also minimizing the damage that results from the attack itself.
Cybercriminals have leverage over you if you don't have any backups because if they restrict access to those files and delete them, you have no way of recovering them. But that leverage disappears if you have it all backed up and you can easily recover it.
However, you have to be careful about where you store your backups. If they are on the same system, they can easily be affected by the same ransomware attack. So, your backups need to be offline and not connected to the network that the ransomware targets. Before you restore your backups, always double-check that they are not infected with the same ransomware, or you could make the situation much worse.
Train Your Employees In Better Cybersecurity Practices
It's not just the IT team that needs to know about cybersecurity. Employees across your business need to understand what they can do to prevent ransomware attacks and how to deal with them if they happen.
By training everybody in good cybersecurity practices, you make sure that everyone understands what malware is and why it can be dangerous. You also help ensure that nobody opens suspicious emails or attachments and that all emails are checked carefully before any links are opened.
There are a number of ways to spot malicious emails. They often come from unknown senders with no contact information. They also contain lots of spelling mistakes and broken English, with urgent requests that demand an immediate response or action. If employees are aware of these tell-tale signs and better understand how cybercriminals operate, they can quickly identify any suspicious emails and help prevent ransomware attacks.
In addition to teaching them how to spot malicious emails, you should also train employees in good password management and sensible information security practices. This means making sure that they only use strong passwords containing numbers, symbols, and upper- and lowercase letters. They should never reuse passwords for different accounts or share them with anyone else. And if their password is compromised in any way, they should change it immediately.
Don't Neglect Software Updates
It's critical to keep software updated, including the operating system and any apps. This ensures that there are no security vulnerabilities within them that could be exploited by cybercriminals. The updates themselves won't stop an external threat like ransomware, but they will minimize your exposure to risk.
Sometimes it can be difficult to update software because many companies have complex IT systems with lots of different programs installed on them, which makes updating each one difficult. But this is another argument for investing in a professional cybersecurity team that knows how to manage updates and ensure that all security weaknesses are handled.
It is especially important that you keep all cybersecurity software updated to avoid any vulnerabilities that could be exploited by cybercriminals. New methods for bypassing cybersecurity software are being developed all of the time. The developers that make the software are in a constant race to stay one step ahead and strengthen the systems, but if you are not using the latest version, you are not fully protected.
Replace Outdated Hardware
Software updates are important, but you also need to replace any outdated hardware too. If you are using computers that are decades old, it is only a matter of time before you are targeted by ransomware or some other malware that can exploit their outdated systems.
Your hardware needs to be able to run the latest security software, but that is not all. You also need to make sure it has enough processing power for the programs you are using. An older computer running an antivirus program with lots of functions may not have the ability to process at the speed needed. This means that any threats will go undetected for longer, which increases your risk of infection. A lot of companies are at risk because their computers are simply too old to support the latest version of the operating system, meaning that they have all sorts of vulnerabilities.
Although replacing all of your computers can be costly, it's a lot cheaper than paying a huge ransom because you let your cybersecurity slip.
Review Port Settings Frequently
Although all ransomware is slightly different, most attacks take advantage of Remote Desktop Protocol (RDP) port 3389 andServer Message Block (SMB) port 445 to gain access to your system.Organizations often leave these ports open for convenience, but if you are not using them, you should shut them down.
This is to prevent ransomware from gaining access to your system through the port that it requires to work. If you have no legitimate reason for leaving RDP or SMB ports open, they should be closed immediately. If you do want to leave them open, limit connections to trusted hosts only. Check settings for any cloud environments you are using too.
Use DNS Web Filtering
Using a DNS web filter can help protect your system from ransomware by blocking any domains that are known to contain malware. Sophos is one example of an internet security company that has its own database of malicious websites, which it updates regularly to keep up-to-date with the latest threats.
DNS filtering will stop employees from visiting fake websites set up to deliver malware. However, it's important to remember that DNS Web Filtering will not block 100% of all ransomware attacks, so it should be used alongside other types of protection too.
Install An IDS
An intrusion detection system (IDS) is a piece of network security software that monitors and analyzes traffic to identify any attacks. As well as reacting in real-time, it also creates an accurate audit trail that enables you to produce reports and analyze incidents retrospectively when necessary.
Once implemented, an IDS will monitor all incoming and outgoing traffic continuously so that it can spot potential threats such as ransomware trying to access your system through RDP or SMB ports. It will alert the cybersecurity team so they can investigate further and take appropriate steps. This could include shutting down certain systems or disconnecting users from specific resources until the threat has passed.
When combined with strong perimeter security measures and regular penetration testing, an IDS provides powerful protection from cybercriminals. It is particularly effective against ransomware because it can identify suspicious activity and raise the alarm before any damage has been done. That way, you can avoid the situation and work on boosting security before another attack happens.
Ransomware attacks are one of the biggest cybersecurity threats that businesses face right now. Unfortunately, many small business owners aren’t aware of the dangers, and they don't have an information security process in place to protect their data. If you want to keep your business safe, avoid downtime, and protect your finances, it's vital that you follow these steps to protect against ransomware attacks.
How Security Ideals Can Help?
Security Ideals offers a unique risk-based approach to preventing ransomware. We work with you or your team to conduct a risk assessment specific to ransomware which creates a risk score for your organization and a list of potential improvements. The outcome is a project plan that can be used to systematically reduce the risk of a ransomware outbreak within your company. Please use the link below to book a free 30-minute consultation where we can discuss your project, share advice, and plan for your risk assessment.
Comments