Ransomware is a sophisticated class of malware (software designed to perform malicious activities) that prevents the victim from accessing his/her data.

47%
59%
71%

Nearly 50 percent of organizations have been hit with ransomware

Email is the main delivery method for ransomware

71% of companies targeted by ransomware attacks have been infected

How a ransomware infection can put you out of business

Ransomware usually combines advanced encryption algorithms to encrypt a victim’s data and subsequently block his/her access.

The people and/or the organizations that involved behind ransomware, demand a payment (ransom) from the victims, to provide them with a decryption key to unlock their data.

Ransomware may also prevent users from accessing their operating system entirely, making impossible to use their PCs.

You may pay the ransom; will you get your data back? Who knows? A ransomware infection can lock you out of your own business!

7 things you should do today, to defend against Ransomware

You need to act on common sense to make it a common practice

You can’t talk about ransomware prevention without talking about Antivirus.

Antivirus/anti-malware is special software that protects your computer from getting infected.

Therefore, you need that software installed on your PC and on EVERY PC WITHIN A BUSINESS. However, ransomware can be quite “clever” and sometimes can bypass that kind of software.

Many vendors now offer EDR programs that can mitigate the weak points of Antivirus/anti-malware. You probably need both!

You need to keep up with the vendors

Some ransomware can take advantage of the weak points of an operating system, or an application, and spread to other computer devices.

Most vendors often release security patches (updates) for their operating systems, and applications, to mitigate such problems.

It is very important to have a process in place to manage, and install, those security updates promptly.

Better stop ransomware from even reaching your network

The best way to defend against a ransomware attack is to prevent it from reaching your devices.

One way to deal with that is by using a “next-generation firewall”. A “next-generation firewall” is a special device that controls the traffic between your network and the internet. Such a device, THAT IS PROPERLY CONFIGURED, may stop an infection before even reaching your business network.

Is it OK if you at least save your Server(s)?

Sometimes you take all the cautionary measures and you still get infected! For example, an employee may connect his personal laptop to the corporate network and start spreading ransomware.

In such cases, separating critical resources, like servers, from the rest of the network may reduce the likelihood of spreading the infection to those crucial systems.

You got infected, now what…?

Got infected and your data have already been encrypted? If you were thoughtful enough to keep an up-to-date backup, you may restore your data back to a point in time, just before the infection.

Your data backup has also been encrypted? If you were thoughtful enough to keep a separate backup, outside of your corporate network (to a cloud service, for example) you may still be able to restore your data.

Pleeeeease, don’t click on that!

Most ransomware initially spread through a phishing email.

A phishing email is an email that attempts to get sensitive information such as usernames, passwords, and credit card details (and, indirectly, money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication.

It is important to train your users to recognize such emails and avoid clicking on links they don’t know about.

Let’s prevent a ransomware’s ability to mess with your files

The idea behind least privilege is that every user, process and application must have the minimum access rights required to do their job.

For example, if user LefterisKarafilis has access to all corporate data, and his computer gets infected with ransomware, the infection will probably encrypt all data that has access to (everything). If the same user has limited access to the corporate data, the infection will encrypt only those files that can access.

Data backups can also benefit from the idea behind least privilege. If you successfully restrict access to your data backups, by allowing access to your backup application only, you may rescue your data backups from malicious encryption.

Putting it all together

There is no magic bullet to defend against ransomware. There is no such thing as 100% protection. However, if you consider multiple levels of controls, such as training, firewalls, patch management, anti-malware, security policies, and so on., you significantly lower the chances of infection.

Preventative measures are not enough though! You need countermeasures in the case of infection. Backup and disaster recovery solutions, incident response plans, test restores, etc., will enable you to recover in the case of infection.