Follow Us
Join our newsletter
Advice for Avoiding a Ransomware Attack
Earlier this month the country once again bore the consequences of a cyber security breach when Russian hackers, calling themselves DarkSide, coordinated an attack on the computer network of the Colonial Pipeline Co., a major gas pipeline that provides almost half of the gas supply to the East Coast of our country. The Colonial Pipeline Co. paid out a hefty ransom of $4.4 million to get control of their business network back from hackers who had taken over. The decision to pay the ransom did not come lightly and was not agreed upon by some experts, such as the FBI who maintain a policy of not paying ransom to terrorists, but the CEO felt obliged to get the gas supply up and running again for the millions of Americans who were being affected by the shortage of gas and millions more who would pay the price as supply could not keep up with demand.
Targeted attacks are no accident, there is a process that hackers follow that is somewhat predictable, but with awareness and security measures firmly in place are also preventable. Good security protocols that are followed and backed up by continuous monitoring of security are the only hope to prevent this from happening to you. Even with vigilant practices an organization weakest point is usually a human error, so training is imperative to prevention.
How ransomware works
The first step of a ransomware attack is reconnaissance. These bad actors research their targets in advance to determine the likelihood of ransom payment and they identify vulnerabilities and access points. Your business should stay vigilant in security measures and have access points monitored and checked regularly for flaws. Once access points are identified, the hackers use their skills exploiting these by obtaining credentials through phishing, using default passwords, or purchasing access to systems through the dark web. The best way to prevent this is to use secure passwords, double authentication, and train employees on staying vigilant against phishing. It’s also a good idea to have any terminated employees’ access completely cut off as early as possible in the separation process.
Once a hacker gains access to your network, the name of the game is to maintain an open door. They do this by using malware to create back doors into the system that ensure maintained entry into your network. The next step is to encrypt or destroy your back ups and move through your network looking for additional systems and back-ups to control, encrypt or destroy. Once in control of your network these threat actors steal your data and use this as leverage to force the organization to pay a ransom by threatening to disclose the stolen data publicly and/or they encrypt as many files and systems as possible across the network to refuse you the ability to utilize your network.
Once your data and network are firmly in their handcuffs, a ransom will be requested to release the encrypted files and allow you access. If the victim organization chooses to pay the ransom, usually an experienced incident response firm is engaged to assist with the negotiation of the demand and facilitate the cryptocurrency payment. If the ransom is paid, a decryption key is provided by the hackers and data recovery can occur. If the ransom is not paid the organization must either recover the files from a clean back up or rebuild the files and system from scratch which could take several weeks or months to recover.
What you can do to avoid ransomware attacks
The dark web is upon us and there are dark forces that work around the clock looking for large payouts and easy targets. Don’t be an easy target! Utilize your IT Security protocols vigilantly, consider a threat assessment by an expert and consider purchasing Cyber Security Insurance for breach response assistance. There are several products available to fit a variety of sizes and types of businesses that protect your business assets in the event of a breach of personally identifiable information, a hostile takeover of your network, interruption of your cloud or the introduction of malware to your system.
Talk to our licensed agent today about products available to protect your organization. In the underwriting process you may find additional tips on security measures that you hadn’t considered before and you can rely on a partner to help get your business through to the other side in case of a cyber security event.
The facts
In 2020 ransom and extortion claims accounted for 1 in every 5 cyber claims, up from 1 in every 10 cyber claims in 2018.
A ransomware attack on businesses is predicted every 11 seconds, and the global ransomware damage costs predicted to reach $20bn in 2021, up from $325m in 2015.
According to an AIG observation, network outages and business interruption from global ransom and extortion claims are lasting 7-10 days .
By 2025, global cybercrime costs is estimated to reach $10.5 trillion.
Sign up for our newsletter.
Have a question? Get in touch.
Our Services.
From the Blog.
Our Company.
Sign up for our Newsletter.
Designed and Developed by Vessel Digital Marketing