Ransomware: How to protect your business against it

Many of my clients ask me why viruses exist. Why some individuals develop this kind of thing. The answer is simple and not very surprising: it's for money of course! Until recently, in the majority of the cases, only productivity was affected. But for some time now, a new type of attack is growing fast: ransomware.

What is ransomware?

Ransomware is malicious software that takes data hostage. To do this, it encrypts them and then asks the owner to send money in exchange for the key that can decrypt them. What does that mean? In essence, the virus will first do a quick search of the infected system and then prevent access to your documents (PDF, JPEG, etc.). Once your data are inaccessible, it will display on your screen a message asking you to pay an amount of money (usually in Bitcoin), otherwise you will lose them. This amount can range from 300$ to 500$ for individuals and up to tens of thousands of dollars for a company. The ransom is often accompanied by a countdown to rush your payment (amount that increases every three days, for example).

Risks associated with ransomware for business

In a company, you have access to data-sharing workspaces. It is in these areas that all data necessary for the enterprise are stored. The virus will encrypt all data to which you have writing access rights, and therefore deny access to all other users. From that moment, if the company does not have a backup system, all data will be lost if the ransom is not paid. And even if it has such a system, a decrease in productivity still remains to be expected due to the time it will take to restore these backups (which can take up to several days depending on the number and size of the documents). Another risk for businesses is that their data can be copied by hackers to subsequently be sold to competitors.

How to protect yourself from ransomware?

The only real way to protect yourself from this kind of problem is to be proactive. Effective prevention will save you a lot of trouble. Here are a few tips:

• Have a reliable antivirus system updated and installed on all your workstations and servers. This is valid both for PC and for Apple computers. Indeed, the number of viruses for Apple computers is steadily increasing. To give you an idea, the number of virus on Mac OS X between 2010 and 2014 was 180. In 2015 alone, it was 948 [1]. Regardless of your operating system, it is practical to equip it with a complete solution for security and monitoring.

• Have multiple backup systems. For example, a local backup (on your premises) and off-site (in the cloud), and ensure that at least one of them is offline so that it is not compromised in the event of a major infection of your network. It is also important to check their integrity periodically to be sure that an error does not occur when saving.

• Cybercriminals often send fake emails that mimic those sent by banks or online shops so that the user clicks a malicious link and they can infect your network. This process is called phishing. Keeping this in mind, you should never open attachments sent by an unknown sender.

• Do not trust anyone! Malicious links can be sent via email or even through social networks by your friends, colleagues or employees whose accounts were infected.

• Update your operating system regularly, as well as your browser, antivirus and others programs. The perpetrators often seek to exploit software weaknesses to compromise your system. At GTI, this service is included in our outsourcing contracts and is also available to customers who opt for a time bank.

• Establish an access control policy that will limit damage in case of infection. In summary, it is not necessary that everyone has access to all files. Ideally, employees should have access only to the documents they need to work on.

• The last point is the most difficult to protect against. It is what we call social engineering. This attack technique exploits human weaknesses. That is to say that the individual who targeted your company is going to impersonate someone you trust (employee of the telephone company, bank, IT department or superior). The techniques and scenarios are endless with this type of method. I will not go into the details, but if in doubt, do not hesitate to personally verify the identity of the person calling. By contacting him, if you know him or by checking the company he says he is working for. And if you still unsure our experts can verify them for you.

What if you are infected by a ransomware?

In case of infection, it is recommended to turn off your computer and to contact your network administrator as soon as possible, so he can take the situation in charge. You'll understand that time is of the essence when such attacks occur! Unfortunately, this type of virus is more widespread than ever and the damage it causes can be particularly disastrous for businesses. It is therefore important to be vigilant and to have good safety habits. The best way to avoid this kind of situation will always be to develop a comprehensive solution such as a continuity plan, because as the saying goes, better safe than sorry!

Léo Bechetoille, Network administrator