Five Steps to Prevent Ransomware Attacks
Welcome to our series of blog posts dedicated to Cybersecurity Awareness Month! This month, we will update you with the latest security news, share some tips and tricks as well as a special announcement about our very own Cybersecurity Techxpo on October 23, 2018 here in NYC. Stay tuned!
- The average cost per ransomware attack on businesses was $133,000 in 2017 (Sophos).
- Global damage cost in ransomware-related incidents is projected to reach 11.5 billion dollars annually in 2019 (CyberSecurityVentures).
- There will be a ransomware attack on businesses every 14 seconds by the end of 2019 (CyberSecurity Ventures).
- Healthcare and financial services remain the top targets for attacks (Verizon Insights Lab).
1. Back up, back up, back up!
The golden rule of thumb is always to have your data back up, even in the age of cloud-based storage. The question now is not “if you get a ransomware attack,” it’s “when you will get a ransomware attack.” It’s better to be safe than sorry.
You might find these backups useful in the case such attacks happen. Instead of trusting that the hacker will give your important data back once you pay them the hefty price, you can utilize these backups. You will have a better idea whether the cost of restoring from backups is more or less than paying the requested fee. Even if you do pay the fees, it is also not entirely guarantee you will have all of your data back.
One further step you could do on top of consistently back up your important files (air-gapped storage, if possible) is to enable automatic backups for you and your team. That way you don’t have to remind them periodically, and thus ensure you always have backups for a rainy day. At MDS, we offer services for backups and DRaaS.
- Educate, engage and empower employees
The 3 E’s that businesses should be mindful of. Humans are still the weakest link in security. Phishing, man-in-the-middle, sniffing attacks… it seems like end users can’t catch a break! User education is becoming more important than ever, as organizations are looking to invest in security training to avoid malware infections and ransomware attacks. Social engineers are becoming more sophisticated, so teaching users the basic knowledge of where the files came from, why the employee is receiving them, and would the sender be trustworthy, is crucial before they engage.
Create a habit for your end users to report anything unusual to your security team, update their passwords regularly, and remind them to be mindful of the websites and services they access is the first step in educating your workforce to be safer. User education can prevent attacks before they even happen
- Limit user’s rights and privileges
To minimize the impact of a potential attack, it is important for your business to make sure that people only have access to the information that is needed for them to execute their day-to-day duties. By limiting a user’s right to access, you are limiting the potential of a ransomware attack spreading throughout your network. You would also reduce the hassle of addressing a network-wide attack, and instead work with one user’s system (hopefully!).
- Keep your protection software updated
While just relying on signature-based IDS is not optimal or even a possibility now, there are still certain benefits to keep your antivirus software updated. As cybercrime evolves, so should our ways to protect our data. By keeping your signature-based protections updated, you are putting together a more comprehensive security solution for your team. These antivirus protections can help your business in recognizing and shielding from known malware.
- Implement a multi-layered approach to security
There is no such thing as overprotection when it comes to security. As traditional defenses are becoming less effective, businesses need to implement additional security layers to prevent against unknown, newly developing malware. Data sanitization could be the first option to consider, as it eliminates the need for threat detection by sanitizing each and every file. The last line of defense would be advanced sandboxing. A more advanced sandbox environment with the ability to analyze the sophisticated behaviors and routines of a malware would help your organization identify potential threats. When utilized together, these components can provide a comprehensive security solution on both the network and endpoint levels.
Your business could be walking a fine line between staying secured and becoming a victim of the latest attack. By following these five steps, you are on your way to ensure you are not part of the rising statistics in cyber attacks today.
Don’t wait until sensitive data is already in the sticky hands of hackers to react to a breach. Stay proactive with MDS and work with us to build out a custom, company-wide security protocol that is effective and easy to maintain.