Ransomware: How to defend your company’s vital data

2019 has been characterized by an unprecedented series of high-profile cyberattacks in the US. City governments like Baltimore and Atlanta, and a number of smaller municipalities throughout the country fell prey to hackers . These attacks, employing ransomware, were simply a variation of, the now too common, consumer data breaches. 

In a ransomware scenario, hackers use malware to invade a target network, often through an infected email attachment. The malware then encrypts the system files, completely freezing the company networks—they are rendered  effectively useless. In exchange for the decryption key, the hackers will demand a large sum of money, usually payable in Bitcoin.

 

In May, ransomware was responsible for paralyzing the computers of the local government in Riviera Beach, FL; the city paid the hackers 65 Bitcoin (almost $600,000) in return for the restoration of their network access. Baltimore’s city network suffered a similar attack, but local officials chose not to pay the ransom, which has reportedly cost the city about $18 million in lost revenues and squandered resources.  

 

Local governments aren’t the only vulnerable institutions—ransomware attacks are now the fastest-growing threat for companies, regardless of size or industry; hospitals, banks, manufacturers, and schools have all been subject to ransomware strikes. 

 

Most companies are inclined to assume that their systems won’t be compromised, until it happens. In the same way that individual consumers tend to believe that they’ll never fall prey to identity theft. 

 

Of course, the lack of serious cybersecurity is just one factor contributing to the escalation of ransomware attacks. As data accumulation becomes an increasingly indispensable element in corporate growth strategies, companies are creating  vast stores of sensitive information that are inherently liabilities, simply because companies don’t know how to properly protect their digital assets. 

 

Attacks are steadily becoming more sophisticated, at increased expense to the targets, which must either pay the ransom or incur the cost of millions of dollars in lost revenue and operational inefficiencies.

 

Fortunately, all is not lost. Companies looking to minimize the threat of ransomware, who are  ready to fundamentally shift their approach to security operations ( from a passive/reactive to an active mode), who are willing to take on a few key suggestions, can arm themselves by taking on the following strategies: 

 

Human fallibility is a huge factor in cyber security—70% of breaches are caused by employee mistakes; an obliviously opened email attachment is one common means of contamination. All employees should receive thorough, regularly-updated training and education in how to identify and neutralize phishing or ransomware emails. Employees should be given regular opportunities to practice responses to attacks that resemble real-world scenarios. 

 

Another important step is to create secure and up-to-date backups of all business-critical information. Backups should be kept and stored offsite. If backing up on a USB or external hard drive, be sure the devices are physically disconnected from the computer. It is strongly recommended that files should be backed up and stored on a secure cloud server with high-level encryption and multi-factor authentication. 

 

 

Between IoT, remote access, and WIFI, there are many network access points that are ripe for infiltration. It’s imperative to monitor every point of connection in your network, so that any network vulnerabilities can be swiftly identified and fixed.

 

An executive-level expert will help ensure that security is always at the forefront of a company’s strategy. Unlike a CTO or CIO, a designated Chief Information Security Officer (CISO) can provide highly specialized expertise to develop, enhance, and maintain a robust and proactive security infrastructure, and ensure that the company is following best practices consistently throughout the organization. A good CISO is a vital investment in your organization’s future—after all, just one breach can take a company out of business.

 

There is a growing cyber insurance market, on the frontlines of assessing and mitigating exposure to cybercrimes. So, companies can add risk mitigation to their cybersecurity arsenal. Along  with partnering with organizations that bolster their cyber defense strategies.

 

While there is no single, absolute defense against ransomware, with these measures in place and the added benefit of spreading security best practices throughout your organization, your business will be prepared for whatever happens. 

 

Related Reading:

Sparking Growth with Cybersecurity in Education