Current events have likely caused many of us to think more than usual about cyber attacks. One of the most common types of attacks is ransomware, where a hacker disables your systems and demands payment for releasing them or providing an encryption key. A ransomware attack is one of the most common cyber crimes, and yet most companies are only prepared from a technical perspective.
Planning and prevention is key. We recently spoke with George Makaye, CEO and Chief Information Security Officer at InfoSec, and he outlined the typical lifecycle of at attack and how you can reduce damage.
Ransomware is malicious software or malware that locks access to data and encrypts it, forcing the company to pay the criminal to restore the data. In some cases, a criminal will add a layer known as double extortion, where in addition to encrypting the data they also threaten to publish it. In an even worse scenario called triple extortion, they will use the data as leverage to demand payment from clients, employees, and vendors.
So why is ransomware a big deal, especially for small to medium sized companies? In the past these attacks were more of just a nuisance, but recently attacks have become much more mechanized and sophisticated. There are gangs or groups working together on attacks; it has truly become a lucrative industry and causes a lot more damage. There are even ransomware as a service providers, allowing criminals with little skill to carry out large or even multiple attacks complete with a portal and attack tracking.
This means it is more a question of when, not if, your organization could be a target.
There are four stages that define the life cycle of a ransomware attack. However, what’s not captured here is the stress and the time involved. Having a plan and taking preventative measures are the best ways to get back online quickly and with the least amount of damage possible.
Proper prevention is the key not only to recovering data quickly, but getting your employees back to work, maintaining your reputation, and reducing the expense of an attack. Including these strategies as part of your overall plan will help you be as prepared as possible.
Paying the ransom is really only part of the “cost” of an attack – it’s not just about money – but lawsuits, reputation, and stress.
If you have a lot of sensitive data (healthcare, government contractor), it may be worthwhile or even required to work with a security consultant. Really size of organization doesn’t matter – it’s more critical that you have someone knowledgeable solely in charge of security. The basic preventions that used to suffice will not usually be effective as criminals are ganging up together using much more sophisticated tools. Even just an annual assessment from an expert is useful. As you grow, you may want to have a relationship that includes monitoring and advisement.
This information is taken from the webinar What to Do in a Ransomware Attack – Tips from a Cyber Security Expert featuring George Makaye, CEO and Chief Information Security Officer at InfoSec. Click this link to watch the webinar replay.
Pocketstop is a communication software solutions company who empowers companies to create personalized, automated messages designed to provide rapid ROI backed by the industry’s best support at a cost customers can afford. Our commitment to excellence propelled us to become the industry’s pioneer in innovative and effective technologies with a portfolio of customer-focused products designed to drive audience behavior, improve efficiency, provide insight and actionable data for decision making by improving their existing internal, employee, stakeholder or customer communication strategies. For more information, visit https://pocketstop.com.