Ransomware operates by playing a high-level game of keep-away. By applying military-grade encryption to the data on a targeted device, ransomware renders its victims powerless to use this data until a ransom is paid. Only after the demanded funds have changed hands will an attacker allegedly provide the necessary keys to decrypt the data… but whether or not they bother is another question entirely.

On the surface, it sounds like a simple problem to solve—the ransom could arguably be just another cost of doing business, right? Wrong. The demanded ransom is typically beyond the means of a small business by multiple decimal points, and again, there is no guarantee that your data will be restored. By paying, you could easily be giving the person responsible for halting your operations the rest of your business' resources.

This is precisely why it is best practice to never pay the ransom… something that hackers make more and more challenging. Some have begun to implement a method called "double-extortion." In addition to demanding a ransom to decrypt the data, an attacker will then demand that they be paid again, or else they'll leak a business' data online.

This puts an impacted business between a rock and a hard place. On the one hand, not paying could end quite badly for their organization, but on the other, they still have no guarantee the hacker will stay true to their word and they'll be funding later attacks and improvements to them.

It also needs to be said that ransomware introduces a mess of challenges where compliance is concerned. It's a safe assumption that a lot of your stored data is sensitive in some way, so if it winds up leaked, you could be facing some regulatory fines for breaking compliance.

At the end of the day, the best way to protect your business from ransomware is to not be infected in the first place. Along with user education, advanced security measures and multi-factor authentication are useful ways to prevent infection. We can help you put these protections in place. Call 877-874-4629 to learn more.

Let's explore how this may be changing in the near future.

The Projections for the IoT

With 127 new IoT devices connected to the Internet each second, it should come as no surprise that estimates place their numbers at around 75 billion in total by 2025. This means that there are plenty of new opportunities for a cybercriminal to find and exploit a vulnerability… both in commercial IoT devices and in the devices classified as the Industrial Internet of Things.

There are already too many examples of how Internet-connected devices have been used to a hacker's advantage. In 2017, the UK's National Health Service was hobbled by a ransomware attack that affected, amongst other things, Internet-connected medical equipment. Video doorbells often stream data without any protections, and other smart home devices have been found to store Wi-Fi passwords in a similar fashion. 

As the IoT continues to grow, it only stands to reason that efforts to take advantage of such weaknesses will increase along with it.

What Can Be Done to Secure the IoT?

Fortunately, things are already in motion to help ensure the IoT is made to be more secure. For example, the signing of the Internet of Things Cybersecurity Improvement Act of 2020 in the US and the Australian government's introduction of an IoT industry-specific voluntary code of practice shows that governments are starting to pay attention to the issues that the IoT has the potential to open up. However, this doesn't mean that businesses can sit back and relax.

On the contrary, there are a few things that a business can and should do to help mitigate IoT-based attacks:

Encrypt Data

There are relatively few IoT devices out there today that feature encryption as one of their standard security protocols. Implementing encryption on a network level makes it so that your data is effectively indecipherable while in transit, rendering it more or less worthless to the cybercriminal targeting it.

Change Default Passwords on IoT Devices

Of course, ALL default passwords should always be changed, but the IoT makes this an even more important practice for a business. Take the few moments required to come up with a more secure password than the device is equipped with initially.

Use Devices from Security-Conscious Manufacturers

One other way your business and your users can help make a change while protecting your own assets is to try to deal exclusively with devices manufactured by companies that take a security-first approach. Voting with your dollars can quickly make a change if enough people do it. Otherwise, it may be wiser to stick with the "dumb" option if it serves your needs just as well.

There is little doubt that the IoT will have an increased presence in modern life in the years to come. Time will only tell if that presence is a secure one. In the meantime, you can trust us to help you ensure that your business is as secure as possible. Give us a call at 877-874-4629 to find out what we can do for you and your operations.

Let’s go through a quick review of what ransomware is, and then what needs to be done to resist it successfully.

What is Ransomware: A Review

Ransomware—the malware that locks down a system until a monetary sum is paid—has been around for a few years, and during that time has expanded and grown in its capabilities. It’s also remained a popular form of cyberattack, with Trend Micro reporting that 84 (that’s 8-4) percent of organizations experienced either phishing or ransomware in the past year… and if we’re being honest, the two often go hand in hand.

There are also dozens of new innovations present in modern ransomware strains, with more and more tricky ways to get past a company’s defenses. Now, instead of just phishing their victims into installing their malicious payload, hackers who use ransomware now twist the knife a little (or a lot) more by threatening to leak data if a ransom isn’t paid. Some enterprising cybercriminals offer RaaS—Ransomware-as-a-Service—to those who want someone to hurt, and are willing to pay to make it happen. Ransomware has become so notorious and even normalized that some attackers have found success by simply claiming to have infected a victim’s PC, bluffing their way to a hefty ransom payment.

Clearly, ransomware is an issue that is not going away anytime soon, which means that businesses need to be prepared to deal with it effectively.

What to Do to Face Down Ransomware

This is one topic that has gotten far more complicated as time has passed, simply because of the innovations we described above. Not all that long ago, our best advice (should one find themselves infected) was to make sure they always kept a backup so they could refuse to pay the ransom and simply restore their data infrastructure after the fact. Now, the double extortion method (exfiltrating data, and then threatening to leak it unless the affiliated company pays a second ransom after they’ve unlocked their systems) makes it dangerous to even do that.

While we will always recommend that a business keep a comprehensive and redundant data backup for the sake of data continuity in general, a backup can no longer be seen as the de facto insurance against ransomware. This makes it even more important that a business do everything possible to keep ransomware out in the first place.

Let’s go over what this will take:

Keeping Defenses Up-to-Date

Even basic firewalls and antivirus programs do a pretty darn good job of filtering out ransomware attempts, so it is important that you put in the effort to keep these protections—as well as all of your systems—as up-to-date as possible. This includes keeping track of any patches that are released for your chosen solutions and promptly applying them.

More advanced protections are also advisable, such as those that monitor your systems and the programs installed on them for suspicious activity. This is particularly advisable where your email comes into play. If possible, have your IT resource configure your email gateway to scan ZIP attachments and block executable files. In short, the fewer ransomware attempts your team needs to deal with personally, the less likely it is that they’ll slip up.

Educating and Evaluating Users

While we’re on the topic, however, it is important that your team is on their guard against ransomware attacks. The people you’ve hired really are your last line of defense against these efforts as they are the ones who are really being targeted. Phishing is a favorite means for a cybercriminal to bypass many of the network defenses we outlined above. Your team needs to be able to spot a phishing attempt and know the proper steps to take should they spot one.

This process will also involve testing your users to see how “on their guard” they actually are. It is possible to run simulated phishing attacks to directly evaluate your team to identify any weak points in your company’s personnel and educate them appropriately. Even your business’ culture should be somewhat founded on the principle of security and maintaining it.

Following Zero-Trust Policies

Of course, there is always the risk that one of your users will miss something and let in a threat. This is why it is also crucial to minimize the damage that an attack on one of your users could potentially have.

A zero-trust policy—one that limits a user’s access to data to only what they directly need to do their particular job—is a good way to limit the damage that an individual user being undermined might do. In addition to this, we recommend that any accounts that offer multi-factor authentication have it enabled. That will add an additional layer of protection between a hacker and your resources that they’ll have to deal with.

Maintaining Backup Practices

Finally, while there are some ransomware attacks that still manage to hurt a business if it manages to restore its data, it’s better to have your data than to not have it. Maintaining a backup that complies with our recommended best practices can still help protect your business from ransomware, as well as other cyberattacks.

Ransomware is a Challenging Threat—We Can Help You Address It

Reach out to us today for our assistance in preparing your business to withstand the influence of ransomware throughout this year and beyond. Give us a call at 877-874-4629 to get started.