Preventing Ransomware Attacks
Malicious software that uses encryption to hold data for ransom has become wildly successful over the last few years. The purpose of this software is to extort money from the victims with promises of restoring encrypted data. Ransomware is malware that encrypts a computer system’s data and demands payment to restore access. Paying the ransom does not guarantee you will get the private key to restore your data. Instead, protect your files by using protective measures in your day-to-day operations. In case of an attack, you can return files to their original state.
Ransomware is like other computer viruses, it usually finds its way onto a device by exploiting a security hole in vulnerable software or by tricking somebody into installing it. The chances of infection can be significantly reduced both by security software and by paying sufficient attention. By using anti-ransomware, you can avoid a situation in which you have to pay horrendous sums for the possible release of your data.
Security recommendations For Dealing With Ransomware.
- Do not pay the ransom: It only encourages and funds these attackers. Even if the ransom is paid, there is no guarantee that you will be able to regain access to your files.
- Restore any impacted files from a known good backup: Always back up your data. Restoration of your files from a backup is the fastest way to regain access to your data.
- Do not provide personal information when answering an email, unsolicited phone call, text or other message: Phishers will try to trick employees as well as individuals into installing malware, or gain intelligence for attacks by claiming to be from IT or a reputable business. Never give out your personal information to unsolicited people.
For organisations to be secure and protected against ransomware attacks and to help with recovery from if they do happen, the US National Institute of Standards and Technology (NIST) has published a series of tactics. NIST’s advice includes:
- Use antivirus software at all times.
- Keep all computers fully patched with security updates.
- Use security products or services that block access to known ransomware sites on the internet.
- Configure operating systems or use third-party software to allow only authorised applications to run on computers, thus preventing ransomware from working.
- Restrict or prohibit use of personally owned devices on your organisation’s networks and for telework or remote access unless you’re taking extra steps to assure security.
NIST also advises users to follow these tips for their work computers:
- Use standard user accounts instead of accounts with administrative privileges whenever possible.
- Avoid using personal applications and websites, such as email, chat and social media, on work computers.
- Avoid opening files, clicking on links, etc. from unknown sources without first checking them for suspicious content. For example, you can run an antivirus scan on a file, and inspect links carefully.
In case of an attack, NIST recommends that organisations follow these steps to accelerate their recovery:
- Develop and implement an incident recovery plan with defined roles and strategies for decision making.
- Carefully plan, implement and test a data backup and restoration strategy.
- Maintain an up-to-date list of internal and external contacts for ransomware attacks, including law enforcement.
The best way to recover from ransomware is to restore data from a backup. Backups bypass the ransom demand by restoring data from a source other than the encrypted files.
Hackers know this, so they develop ransomware that scans the network for backup files. After restoring from a backup, you still must remove the ransomware from the network. An effective way to stop malware from encrypting backup files is to keep a copy of your backups offsite. Cloud backups are the typical choice for businesses that need an offsite backup solution. Using cloud backups, you keep a copy of your files safe from ransomware and other cyber security threats.
You Might Also Read:
