The devastation that can be caused by computer viruses and malware is
something all businesses cannot afford to ignore. These hindrances are
not going anywhere anytime soon (except maybe into your computer), which
is why it is crucial for businesses to ensure they are protected, so
data is not compromised.
Ransomware has been around for many years with Reveton, Cryptolocker
and Cryptowall being most well-known. With the significant threat it
brings to organisations, business owners and their employees should know
what to look for to stop them being caught out.
Ransomware aims to encrypt files on a system’s hard drive by using an
indestructible key. Once a ransom is paid, it is then decrypted by the
attacker. The process is supported by the existence of crypto
currencies, which facilitate payment to the attackers.
The majority of ransomware occurs via email, often in the form of a
shipping notification from a delivery firm, which can appear very
legitimate to the recipient. These emails are sent on mass, to maximise
the chance of attackers getting a result. And they do – millions of
pounds have been paid out to these attackers.
According to an international study by anti-malware software company
Malwarebytes, nearly 40 percent of businesses experienced a ransomware
attack over the last year. Of these victims, over a third lost revenue
and 20 percent had to stop business completely.
Simon Ahearne, managing director of IT and communication company SA1
Solutions, explains there are a number of ways businesses can protect
themselves from ransomware.
“Having effective back-up methods in place is a necessity. This way,
if an attack does occur, you are able to safely recover your data from a
back-up once the infection has been removed. You therefore have peace
of mind that you can’t be held to ransom for your data with this back-up
method in place.”
Another obvious step is to ensure your business has the most current
updates for its anti-virus software. Software manufacturers frequently
release new security updates and patches with the aim of stopping
ransomware infecting devices from the outset.
Ahearne suggests this can be taken a step further with additional
network monitoring software. “This runs above your usual anti-virus
software and monitors all traffic as it enters and leaves the network,
helping to block anything that may have been missed by anti-virus
software,” he added.
Ransomware, like all malware and viruses, is continuously evolving to
counteract protection methods, which makes achieving total security
extremely difficult. Knowing what action to take if you have been a
victim of ransomware is therefore important to help minimise damage.
“Ransomware works on the premise of human weakness, so it needs to be
highlighted to everyone in a business that any potential or clearly
identified infection needs to be alerted to the necessary department and
support service immediately,” Ahearne suggests.
“Measures can then be taken to prevent the infection spreading to
other devices and other parts of the network. The back-ups need to be
checked to make sure they’re clean of the encrypted data. Once
confirmed, the infection can be removed and the data restored.”
If you do not have a clean back-up of the data, you will need to find
the ransom note on the infected device. This will assist in identifying
the type of ransomware received. Some forms of ransomware have had
their encryption deciphered, so if you have one such infection, your
data is able to be recovered with the correct decryption tool.
If you are unfortunate enough to have been infected with ransomware
that does not yet have a decryption tool, you will be facing data loss.
However, it can be surprising how much can be recovered from older
versions of documents, emails and their attachments.
“It should only be a last resort to obey the instructions of the
ransom note to get your data back. But even if a ransom is paid to
attackers, there is no guarantee you’ll get back exactly what was taken.
These attackers are criminals after all,” Ahearne concluded.