Ransomware Protection

Ransomware is a dangerous type of malicious programming code also known as malware which is used by cybercriminals to extort money from individuals, organizations, and businesses. While there are many ransomware types, a typical attack encrypts the victim’s data, deletes their backups and then presents the user with a message that demands a ransom payment – usually in the form of digital crypto currency such as Bitcoin.

After the ransom is paid, the criminals are supposed to provide a decryption key – although it’s important to note that nearly 40% of the victims who pay the ransom never regain access to their data.

Organizations which are hit with ransomware often experience these attacks as a sudden event when access to the system or data is lost. But the reality is that a ransomware attack could be in the works for days, weeks, or even months before victims become aware.

Here’s are some important rules to follow in order to avoid ransomware:

1. Do not provide any personal information when answering an email, unsolicited phone call or text message –  Cybercriminals will often try to trick employees into installing malware, or gain intelligence for attacks by pretending to be someone else. Be sure to contact your IT department if you or your coworkers receive suspicious calls or emails.
2. Ensure that all systems and software are up-to-date with relevant patches – Regular patching of vulnerable software is necessary to help prevent infection and can be easily accomplished utilizing our fully managed Proactive Patch Management service.
3. Use reputable endpoint protection antivirus software and a network firewall – Maintaining a good up-to-date endpoint protection solution and a properly configured network firewall are critical when it comes to ransomware protection.
4. Utilize content scanning and filtering on your mail servers – A strong email security solution is needed to scan inbound e-mails for threats and block any attachment types that could pose a threat.
5. Use a Managed Detection & Response Solution – Next Generation Managed Detection & Response services utilize advanced techniques to find ransomware which got past your firewall and antivirus software. Features such as Ransomware Canaries can make all the difference in protecting your network and data.
6. Ensure that you have proper backups both onsite and offsite – Having a good backup strategy is a critical layer of your ransomware protection strategy. Having a secure offsite managed backup is your last line of defense against ransomware. If a ransomware attack gets past your multiple lines of defense, your backups are necessary to quickly restore your data.
7. Enroll your employees in continuous Cyber Security Awareness Training – Employees can be your first line of defense or your achilles heel and it is critical they they be properly trained on a continuous basis to keep up with the ever evolving ransomware threat. Cyber Security Awareness Training can ensure that your staff will know what to do and what not to do when faced with a ransomware threat.

Absolutely Yes – any computers that are connected to the Internet should be covered by multiple layers of security. The way attackers often work is that they will attack a less secure or older device on your network, or an employees home computer that connects through VPN, to then gain access to a core network where your larger assets are. Securing the edge is thus vital to reducing risks.

This is something that we can discuss with you to get to the right balance. For core and connected servers, we would recommend the highest possible levels of protection. This can be combined with standard levels on less critical assets. It is a matter of common sense to find the right balance. It is always best to prevent a breach in the first place than to need to remediate after an attack was successful.

If you are the unfortunate victim of ransomware, removal can be quite difficult. You basically have three options.

First Option:
You can restore your system from a backup. You’ll however, need to ensure your backup hasn’t been tampered with, especcially since new ransomware strains target backup files and backup software.

Second Option:
Reformat the hard drive, wiping out all the data (including the infection), then reinstall the operating system and all applications. It is important to note that, without a proper backup, you’ll lose all of your data and will still face the threat of future ransomware attacks.

Third Option:
Finally, you can pay the ransom and hope the decryption key works and your data will be restored. Just remember that 40% of those who pay never regain their data, so preventing an attack before damage is done is a much better approach.

As you can clearly see, it is far better to have proper ransomware protection measures in place to prevent a ransomware infection in the first place, then to clean up your systems after the fact.

Given the ever expending array of ransomware families and the individual strains within those families, how you decrypt your data following an attack varies.

In some cases, if you are very lucky, there are decrypting software tools available online for certain types of ransomware. They are created either because a particular strain has been thoroughly studied since it appeared, or because a researcher found a flaw in the encryption used by the cybercriminals. If you can determine the exact type of ransomware that has encrypted your files, you can search to see if a decryptor is available.

Unfortunately, in many cases, the popular ransomware strains have such strong encryption that decrypting files is just not possible and for the most part, there are no decryption options for modern ransomware families.

A much better option is to restore your system from a secure backup, which recovers your files.

Ensuring that you have a behavior-based ransomware blocker such as a good Managed Detection & Response system (MDR) will also prevent future infections.