Ransomware attacks are on the rise. In 2021 alone, businesses around the world were victims of a 105% increase in attacks. Sonicwall’s 2022 Cyber Threat Report also notes a 755% increase in the healthcare industry and a 1,885% increase in attacks on governments worldwide.
One result of the COVID19 pandemic is that businesses around the world are utilizing remote workers, creating a bevy of new opportunities for cybercriminals to exploit digital information. Ransoms are high – JBS USA, the world’s largest meat supplier, paid an $11 million fee in Bitcoin to end their digital hijacking for instance – and even the average setback in 2021 was $1.85 million.
We put together this list of ways your business can fight back against the surge in ransomware attacks. We developed this acronym – Determent, Planning, Action, and Recover or DPAR* – as a way that you can always remember the steps to fighting back against ransomware:
*Our acronym team is currently on a sabbatical performing a one-person show about the life and times of the French chef of the Duke de Richelieu.
The most important step you can take toward fighting back against the surge in ransomware attacks is to deter cyber criminals from targeting your organization in the first place. And while it’s not always the case that you can fully prevent attempts, there are ways to help keep your team from becoming a target.
No matter the stakes or the sport, the best offense is a good defense, and your entire team needs to be on the same page when it comes to developing that defense. Your entire C-suite team needs to sit down and discuss the entirety of your digital portfolio – including how to apply your own internal ethos to your approach.
Approximately 75% of all Ransomware attacks begin with either a phishing email or a Remote Desktop Protocol (RDP) compromise, meaning absolutely anyone from third-party vendors and freelancers to remote employees and beyond are all capable of being an accidental source of compromise for your organization.
Here are six ways businesses are proactively deterring ransomware attacks in the first place:
Understanding where your major risks are – and how to keep them safe – should be your number one priority. Create a tactical team, starting with senior leadership, that can prepare your organization for any kind of eventuality. Greg Hughes, the CEO of Veritas, said recently, “The threat has really evolved from targeting big business to also targeting small and medium-sized businesses,” meaning anyone anywhere can end up as the target of an attack.
To avoid reaching the point of paying a ransom of any amount, it’s critical your team be aware of the critical assets that could be the target of a breach. Additionally, consider elements like what the plan is for your backups, and detail what that means for a full-fledged recovery effort including how long your team would be down without the ability to work.
As a part of your plan, devise a way to test your recovery efforts as well. Just like the fire drills you did when you were younger, testing is the best way to develop muscle memory in the event of a disaster. Practice this plan, noting how long each process takes and whether or not your ideas were successful or struggled to get off the ground.
Ask your current IT if they offer tabletop exercises that can run you through hypothetical breach scenarios. This is an extremely useful way to see exactly how your team would handle the real deal.
Even as you discover a digital break-in, the clock has already been ticking. No matter how the breach occurred, time is now of the essence so your team must be well aware of the plan we discussed above.
The quicker you act, the quicker your business is back to normal, but the situation isn’t always black and white. In the unfortunate situation that you fall victim to a ransomware attack, here are the four steps we believe are critical to getting back to business:
Regardless of your plan of action, recovering from a ransomware attack can be a slog.
On the one hand, if you decide to pay and get a decryption key – and that decryption key actually works! – there is usually a considerable amount of work to be done thanks to the attackers turning off servers that aren't designed to be shut down that way.
Additionally, if you pay your ransomer, the attacker essentially becomes a sort of business partner, something most businesses on the up-and-up would like to avoid.
If you don’t pay, and instead you’ve kept all the proper backups, rebuilding networks from backups is still time-consuming – the average downtime a company experiences following a ransomware attack is 21 days.
The good news is prevention isn’t just possible, it’s entirely effective. Cyber security takes time, knowledge, and effort to implement correctly. The time spent on implementation is a far cry from how much time and money you will spend recovering from a data breach.
For more information on what your small business can do to remain vigilant in today's environment give us a call at (864) 552-1291 and we'll help you evaluate capabilities and options. Also, sign up for PTG Tech Talk and consider following us on LinkedIn, Facebook, and Twitter!