Avoiding a ransomware lockout
Cybercriminals routinely attempt to hold businesses hostage with malware that encrypts data and can freeze an organization’s network. Here’s how you can make it harder for them to succeed.
RANSOMWARE IS A TYPE OF MALWARE that encrypts data on computers, mobile devices and networks and locks users out. It allows cybercriminals to demand payment for the release of data or return of service. It can be delivered in various ways, including fraudulent emails and websites, unpatched remote network portals and pop-up warnings with phony links to technical support.
Cybercrime that leverages ransomware is becoming more sophisticated and ransomware demands are increasing. The average ransom demand in Q2 of 2021 was $136,576, with median ransom payments hovering around $47,000.1 But it’s not just money at stake. Criminals also may threaten to release proprietary data or intellectual property they have seized to damage the fortunes or reputation of a business.
$4.24 Million
Average total cost of a data breach.2
Percentage of successful malware incidents that delivered ransomware.3
2 Rank of ransomware among enterprises' most serious mobile security concerns.4
Percentage of ransomware victims that paid their ransom demands.5
Percentage of ransomware incidents that occurred after normal business hours.6
11
Projected number of seconds between each ransomware attempt by 2021.7
$4.24 Million Average total cost of a breach.2
Percentage of successful malware incidents that delivered ransomware.3
Rank of ransomware among enterprises' most serious mobile security concerns.4
Percentage of ransomware victims that paid their ransom demands.5
Percentage of ransomware incidents that occurred after normal business hours.6
11 Projected number of seconds between each ransomware attempt by 2021.7
Ransomware is often a crime of opportunity. It works because the perpetrators understand that a targeted business or individual has been compromised at a time when they can ill-afford to interrupt service or operations. Targeting hospitals during a pandemic, businesses that can be ruined by a few hours of downtime or cities responding to a crisis are just a few examples of this opportunism.
There is no infallible defense against ransomware. Criminals continue to refine software and access methods and may even sell particularly effective strains to less-adept hackers. But individuals and businesses can protect themselves through cyber education and, most importantly, preparedness. Organizations that develop backup and remediation plans can give themselves options that can greatly reduce the severity and length of a ransomware incident.
How ransomware attempts can succeed
Like other forms of malware, ransomware often is packaged into communications that contain malware or hyperlinks to infected sources. The criminals rely on unsuspecting device users responding to prompts or following links that allow the malware to load.
As businesses and supply chains become more interconnected, ransomware is also launched through vectors such as weaknesses in third-party networks or unsecured back-ends of legitimate websites that help mobile and off-site workers access company servers.
In some cases, cybercriminals may first access a company’s network undetected. They will take time to learn how the organization operates and where its network is weakest. It may be months before they decide to launch the ransomware, but the reconnaissance can make the attempt much more effective.
Prevention begins with preparedness
Thwarting ransomware attempts begins with understanding what services and data are most valuable to an organization. If a company depends on uninterrupted service for its customers, it should explore how it could maintain service should criminals seize control of the network.
Whether a company needs to protect its finances, data, reputation or services, there are several steps to take that greatly reduce the risk and potential damage of a ransomware incident:
- Regularly back up critical systems. Critical data should be backed up daily in locations outside the primary company network. Encryption technology can provide another layer of defense for the most critical or sensitive data.
- Maintain lines of defense. Ransomware prevention and anti-virus software should be installed, and network scans should be conducted regularly. Email filters can block known sources of ransomware and spam.
- Build a formal, well-defined ransomware response plan. Companies should construct a step-by-step playbook that establishes response chains of command and describes specific actions employees must perform.
- Promote secure online interactions and organizational preparedness through training. Decision makers should educate employees about the risks of clicking on suspicious emails and using public Wi-Fi networks when working remotely. They should provide training materials that keep employees current on the digital threat landscape and, when possible, run cyber-event simulations to help develop the organization’s incident-response capabilities.
To help keep your account information safe and secure during this period, make sure your contact information is up to date and set up security and account alerts so we can stay in touch. Remember, if we need to reach out to you, we’ll NEVER ask for personal or financial information or an access code through email, text or unsolicited calls. Visit our Security Center or the Federal Trade Commission’s Coronavirus Scam Tips on how to recognize potential scams and learn more about how to keep your accounts safe.
A private wealth advisor can help you get started.
1 Coveware Incident Response Team, “Ransomware Costs Double as Ryuk, Sodinokibi Proliferate”
2 IBM Security, “Cost of Data Breach, 2021”
3,4 Verizon, Mobile Security Index, 2019
5 CyberEdge Group. “Cyberthreat Defense Report, 2021”
6 FireEye Threat Research, “They Come in the Night: Ransomware Deployment Trends, March 16, 2020”