Cyber Risk Management: Stay Safe From Ransomware

Ransomware is on the rise. And it is serious threat to businesses. Has your organization taken action to prevent ransomware from attacking?

Ransomware is a type of malware that infects a computer and blocks access to the files until a ransom is paid. It may even threaten permanent destruction of the information unless you pay.

What might it look like? U.S. Computer Emergency Readiness Team (US-CERT) shares the following examples of intimidating messages from ransomware:

• Your computer has been infected with a virus. Click here to resolve the issue.
• Your computer was used to visit websites with illegal content. To unlock your computer, you must pay a $100 fine.
• All files on your computer have been encrypted. You must pay this ransom within 72 hours to regain access to your data.

Whether your organization has 1 computer or 500, ransomware is a real cyber risk. These scams can result in the loss of sensitive data or proprietary information, a disruption to your business operations, damage to your company’s reputation, and the costs associated with restoring your computer systems and files.

Clearly this isn’t a cyber threat you want to mess with. So what can you do to protect your organization?

1. Take action at the network level for system security.
2. Educate your employees on how to prevent ransomware and how to recognize if their computer has been infected.

Systems Security At The Network Level

At the network level, you can employ strategies to help protect the security of your systems. US-CERT recommends the following preventative measures to be taken:

• Employ a data backup and recovery plan for all critical information. Perform and test regular backups to limit the impact of data or system loss and to expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
• Use application whitelisting to help prevent malicious software and unapproved programs from running. Application whitelisting is one of the best security strategies as it allows only specified programs to run, while blocking all others, including malicious software.
• Keep your operating system and software up-to-date with the latest patches. Vulnerable applications and operating systems are the target of most attacks. Ensuring these are patched with the latest updates greatly reduces the number of exploitable entry points available to an attacker.
• Maintain up-to-date anti-virus software, and scan all software downloaded from the internet prior to executing.
• Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services. Restricting these privileges may prevent malware from running or limit its capability to spread through the network.

Educate Your Employees

You cannot prevent ransomware attacks at the network level alone. Your employees are the users and they are the ones who will decide to click or not to click on pop-up message and attachments. To keep your network and computer safe, educate your employees on how to avoid ransomware. Consider the following tips:

• Do NOT open unexpected or suspicious email attachments or links. Even if you know the sender, don’t click unless you can confirm the email is legitimate. In most cases, you receive email in the context of a business conversation or activity. An email coming out of nowhere should strike you as suspicious. If you know the sender, make a quick call or send a separate email to confirm that the email is really from the sender. If you don’t know the sender, delete the email.
• Think twice before clicking on links unless you know their source, and always avoid ads. Hackers use a technique called social engineering fraud to create legitimate-looking emails that trick users into clicking links and ads loaded with malware. 
• Keep your home and work computers, smartphones, and tablets current with the latest security patches and antivirus software updates.
• Limit Internet use at work to business. You’re always at risk, even on “legitimate” sites. Ads and links on shopping sites also expose you to malware, and online games are notorious malware sources.
• Don’t install applications a website says you “need” to view or access content. These types of approaches can be used to install malware on your machine or device. If ever in doubt, check in with your IT Team for assistance.

Don’t forget to inform your employees about what to look for and how to know if your computer has been infected. It is important to recognize it early and report it. Here’s what to look for:

• Your files are inaccessible. For example, a file could become corrupted, leaving it unable to be opened. Or the file could have been changed to a different file extension – such as a Word document now appearing as a MP3 file.
• You get a notification that your files have been encrypted.
• New browser toolbars appear that you didn’t install. 
• Your default search engine changes unexpectedly. 
• Your antivirus software is disabled.
• You suddenly have a new homepage when you open your browser. 

Ransomware is a serious threat. Make sure your cyber risk management efforts include preventative measures and education of your end users to prevent ransomware from attacking your computers and networks.