Preventing Ransomware in Your Heavy-Duty Business
A very dangerous type of malicious software has grabbed the spotlight in the tech world over the last few years, and for good reason. Numerous individuals, businesses, and public institutions have fallen prey to attacks by the malware programs collectively known as ‘ransomware’.
Ransomware has become popular among black market criminal hackers in recent years for its ability to efficiently, and anonymously, extract large sums of money from victims. It earned the name ‘ransomware’ because it works by infecting the sensitive data on your computer or network, and locking it with encryption, so you can no longer access it. Ransomware effectively holds your most important information hostage.
Once your data is locked down and out of your reach, another file will open with instructions demanding a certain sum of money in exchange for the key which will unlock your precious data. These sums can range anywhere from $500 to upwards of $1 million, and beyond, depending on the size of your business or organization. If you don’t pay, your stolen data will be permanently infected and they will move on to their next unlucky victim.
Ransomware can happen to anybody, and it’s frighteningly easy to become infected. An innocent-looking email might arrive in your inbox one day while you sip your morning coffee, asking you to download an attachment or follow a link. This email might come in the form of a fake shipping order, a receipt, or a “new client” asking you to check out an attached document. If you make the mistake of opening the attachment, you are immediately infected by ransomware, and your most valuable business data is in the hands of a criminal. Once they take control of your data, you cannot access it without the key they create. What’s more, many ransomware programs are designed to spread throughout an entire computer network. By infecting all of the machines in your office, including personal devices and laptops connected to the network, your personal data and the personal data of your employees can be held ransom, too.
While it’s an extraordinarily difficult situation to manage once you’ve fallen prey to a ransomware attack, the best approach is to avoid the disaster in the first place. With a bit of preparation and prevention, you can ensure that you never lose control of your most important business records.
KNOW YOUR SOURCES
Knowing how ransomware works is the first step in creating a security plan to ensure your business avoids the tragedy of a ransomware infection. The next step is to put in place a multi-faceted protocol that protects your company’s sensitive data, even in the unfortunate event your system becomes infected with malware, despite taking all of the possible precautions. The security of your data starts with you, and your employees, being educated about how to spot a threat and avoid it.
Because ransomware is an external attack, which often arrives by way of an email disguised as a legitimate communication, it is important to always pay attention to the details when opening emails. Before opening an attachment, double-check to make sure the email came from a trusted source. Take a look at the sender’s email address, and make sure it’s someone you recognize and know to be safe. If the email came from an unfamiliar address, do not open any attachments connected to it.
Another way ransomware can get a foot in the door is by way of malicious programs downloaded from the internet. Be extremely cautious about downloading any type of file or program online, and look for the identifying characteristics of a legitimate source if you do need to download something.
To determine the legitimacy of a website or download link, the first thing to verify is the address of the website you’re visiting. Ideally, any website offering a download or asking for payment information should have an address that starts with *https://*, and should be accompanied by a padlock icon in the address bar.
The ’s’ after the ‘http’, and the padlock icon, are the digital signatures of an active security protocol on the website you’re visiting. While it’s not necessarily a guarantee of perfect safety, it is a good sign that the owner of the website you’re browsing has taken some important steps toward keeping you secure, and is less likely to be a source of malicious downloads.
A second and very important, signal of legitimacy is a certificate on the download itself, called a ‘Trusted Publisher Certificate’. You will spot this on the first window that opens when you initiate a download online. If you initiate a download and the publisher field is blank, or reads “Unknown Publisher”, beware! You might be on the verge of installing dangerous malware on your machine.
While it’s vital that you, as a business owner, know how to spot a potentially dangerous email or download, it’s equally important to make sure every one of your employees know these rules. Anybody who accesses a computer in your company should be trained to identify potential security risks and know how to follow the plan you put in place to protect your data. Along those same lines, it’s also very important to limit the way your employees are able to use the computers on your business network. You can put an excellent security plan in place, and still fall prey to ransomware or other malware infections by an employee visiting a disreputable website on company time.
If you still have lingering doubts about a particular website or download link, you can utilize a free online tool such as https://www.virustotal.com. VirusTotal is a tool provided by Google, enabling you to check a website address or download link for potential malicious activity. This technique, paired with a strong firewall and antivirus system on your company computers, can go a long way toward securing your activity online. But, even these are not bulletproof, so caution should always be exercised when navigating the internet with a computer on your company network.
AN OUNCE OF PREVENTION
Now that you know the basics for determining whether an email or download, is safe, you’re ready for the next step of building a security plan for your company’s precious data: Backing up your most important files.
Backups are an incredibly important, but too often overlooked, strategy for protecting your data. It’s easy to get busy tending to your company and become complacent about doing regular backups, but the importance of making it part of your regular business maintenance can’t be stressed enough. Having frequent, secure, and redundant backups of your data can mean the difference between a crippling loss, or a relatively minor inconvenience to your company. Ideally, these backups will be performed daily, so that you suffer no interruption of service or loss of vital client records if you do fall prey to a ransomware attack.
Because we know that ransomware is designed to infect entire networks, your backups should never be kept on a machine that is connected to your network. Instead, your most important files should be backed up on a secure and safe location behind lock and key. If possible keep multiple days of backup in the event that one of your more recent backups is also infected. If you’re unsure about how to do this, contact your local IT professional for help. It is a small investment of time and energy, but one which can absolutely save your business, and bottom line, in the event of a malicious ransomware attack.
DON’T BECOME A STATISTIC
The internet is an amazing and revolutionary tool, helping us succeed and prosper in ways unimaginable only a decade ago. With this opportunity comes a responsibility to keep ourselves safe in the wilderness of malware and ransomware attacks. These digital criminals rely on volume to profit from their attacks. They know that not every victim has the desire or means to pay a ransom in exchange for data, so their success depends on finding enough unprepared, gullible, and uninformed victims who will pay these ransoms, and keep them in business. Don’t be one of these unfortunate business owners!
By following a few simple rules, like knowing and verifying your email and download sources, educating yourself and your employees about the dangers of malware, exercising caution online, and performing regular backups of your data, you can effectively limit the ability of ransomware attackers to profit from your misfortune. If enough of us were to follow these rules, we could put these digital criminals out of business altogether, while protecting our own businesses from theft and misfortune online.
