How to Prevent Ransomware Attacks

Ransomware attacks are malicious software designed to block access to a computer’s storage.

It comes in many forms and from many different places, but at its core, it’s a brute force type of software that tries to encrypt your files or your systems so that you can no longer access them until you pay a specified amount of money.

Unfortunately, no industry and no system is safe from ransomware attacks. You can do the best you can to prevent it and be able to remediate against it.

Many organizations choose to pay the ransom rather than recovering their systems because it’s either too costly to recover or they don’t have the right systems in place to do so.

But paying the ransom is risky because it does not always work. Many businesses pay, but the attacker keeps rolling-out more ransomware — it just works for the attacker.

Because there is no good way to completely 100% prevent ransomware, the best way to prevent ransomware is to be able o remediate against it quickly.

Understanding Ransomware Attackers

Generally, ransomware attacks aren’t targeted at a specific organization (although sometimes they are). Instead, most attacks are implemented through mass-spam attacks or wide-scale website manipulation. The attacker is trying to impact as many end-users as possible.

These attackers aren’t specifically targeting your data, rather, they’re just trying to get paid. So stealing your data or getting into your organization aren’t their goals. These attackers are solely focused on trying to lock you out.

The common method is to ‘throw everything at the wall and see what sticks.’ Basically, attackers will send out mass amounts of spam (e.g., during tax-return season or during the Christmas and holiday season) with malicious links. Their goal is to trick random people to click those links and, in turn, lock the end-user out of their computer by encrypting their files.

See How You Can Stop Cyber Criminals From Harming Your Small Business:

• Top 7 SMB Cyber Security Trends in 2019
• 10 Cyber Security Gaps You Probably Didn’t Even Notice
• How to Create a Business Continuity Plan

How to Mitigate Ransomware Attacks

End-User Training

The first and most important method is end-user training.

For businesses, this means training your employees so that they learn to recognize how spam has potential ransomware in it (as well as other types of viruses). You can teach your staff on how to identify malicious links and websites.

In addition, you should have a good computer-use policy in place so that your employees refrain from visiting high-risk websites. The idea is to keep ransomware out of your organization by just avoiding the situations where it can enter, most of which happen through end-user error.

While cyber security training is an ongoing effort, cyber threats are evolving everyday.

You need to keep your employees up-to-date with new and developing threats, such as giving them more common examples.

We use Novafor. Novafor is a great training platform for your employees. It’s basically a series of videos with some interactive questions at the end. The lessons are short and informative, but the interactive questions are important because they’ll ensure your employees are getting the relevant points, and be able to retrain if necessary.

Phishing Tests

The other important part of Novafor is phishing tests. So phishing tests are not, as most people apparently think, to catch your employees red-handed. Rather, the whole point of phishing tests is to raise awareness on a consistent basis.

Training is done at a specific point and time, such as every 3, 6, 9 or 12 months, but it doesn’t keep your employees perpetually aware. So with phishing tests, you can keep that awareness front of mind and, in turn, identify vulnerable staff members.

Certain employees need better training than others. By sending phishing tests each month, you can see which areas you’re failing in and where you’re succeeding. These insights will help you identify areas in your training or processes that need to be changed.

How to Recover from a Ransomware Attack

While training is a must, no amount of preparation will necessarily prevent a ransomware attack. Someone — i.e., an employee, client, or vendor — will make a mistake with a malicious email or message, and you will be affected. You need to be prepared for the worst-case scenario.

You need to equip yourself to overcome an attack, otherwise, you will be paralyzed for days, if not weeks, and may end-up losing your data.

Thus, the key to ransomware prevention is to be prepared to remediate (recover from) an attack when it happens, and remediate quickly.

If you have a good backup or good disaster recovery policy in place, you could remediate the damage from a ransomware attack within an hour, if not within minutes.

It’s an easy thing to remediate, but it keeps your product productivity up. You don’t have to consider paying a ransom, and you don’t hurt your company or lose revenue.

What’s a Disaster Recovery Plan?

A disaster recovery plan is an organized and documented way of recovering from catastrophic failures in your network.

It’s not limited to just cybersecurity or ransomware.

It could be hardware failure, it could even be an act of God or act of nature that destroys your building or makes your building that you work in unavailable where those resources are.

It’s very useful when it comes to ransomware because it lets you quickly recover from an issue, but it should be defined more broadly and cover all aspects.