Swindon & Wiltshire News
Expert opinion: How not to fall victim to ransomware
It’s been 27 years since the first piece of ransomware, the ‘AIDS’ Trojan, first began encrypting file names and demanding payment to restore them.
More than a quarter of a century later this approach is still in use, even as our software has become exponentially more complex.
However, the delivery mechanism is becoming more sophisticated, and more common.
The increase in the effectiveness of spam filters initially saw senders of ransomware turn to phishing emails to target users more personally, but increasingly criminals are opting out of the spam/filter arms race entirely in favour of hacking insecure websites and planting malicious code which runs on un-patched users’ computers.
If you’re an individual there are online resources you can turn to. AVG have a page on their site which lists several useful tools for decrypting affected files.
If you are assessing the threat to your business however, there are many things to consider when it comes to prevention efforts and the creation of a disaster recovery plan to help you restore your systems in the event you get hit.
Prevention
- Employees need to be made aware of the existence of ransomware and the possible delivery mechanisms. They need to have an appropriate amount of caution when accessing email and the web.
- All your software and firmware should be patched in good time.
- Ensure any antivirus and malware detection tools are also kept up to date.
- Only grant administrative access to users who really need it.
- Examine your access controls. Do users need to have read/write access to every area or are there areas which could be restricted to read only for the majority?
- Disable Microsoft Office macros for files which have arrived via email.
- Lock down access policies to prevent programs running executable files from locations known to be used by ransomware.
Disaster Recovery
Make sure all your data is being backed up regularly and that those backups are being securely stored outside your network. This is something we can help with, so if you don’t have a business continuity plan in place, please contact us and we’ll be happy to help.
If you have a disaster recovery plan in place you’ll be able to get the affected system back quickly and simply but even if you don’t, be aware that paying the ransom is no guarantee you will actually receive the key to decrypt your affected files. All you can be sure of is that you just made it more profitable to them to continue their attacks.
For more information about integrating Apple or Microsoft products and services into your business, call Tim at Thirdline on 0800 082 2420 or email tim.harris@thirdline.eu
