Image Source

Just like Physical kidnapping, your critical data can be stolen, and ransome can be demanded for.

What is ransomware?

Ransomware is malware that holds your computer or device data hostage. The files are still on your computer, but the ransomware has encrypted them, making the data stored on your computer or mobile device inaccessible.

How Ransomware attacks work.

Hackers use malicious software to lock and encrypt the files on your computer or device. They can then hold those files hostage, disabling you from accessing your data until you pay a ransom. When you do pay, they may or may not give you a decryption key to regain access.

Types of ransomware

The seven most common types of ransomware are crypto malware, lockers, scareware, Mac ransomware, and ransomware on mobile devices.

Defending against Ransomware

There are steps you can take to help protect your computer and devices against being infiltrated by ransomware. Here’s a list of tips to remember.

Always backup your data: The best way to avoid the threat of being locked out of your critical files is to ensure that you always have backup copies of them preferably in the cloud and on an external hard drive. This way, if you do get a ransomware infection, you can wipe your computer or device free and reinstall your files from backup. 

Install reliable ransomware protection software on your devices: Stay updated. Keep your operating system, programs, and security software up to date. This helps to protect you against the latest malware with the latest security patches.

Be cautious when online: Malicious websites and pop-up ads are just waiting for you to click on them.

Don’t surf the web on public Wi-Fi networks: Using a VPN short for virtual private network — can help keep your data private.

Never use USB sticks from unknown sources: You don’t want to provide an easy gateway for hackers.

Implement a security awareness program: Provide regular security awareness training for every member of your organisation so they can avoid phishing and other social engineering attacks. Conduct regular drills and tests to be sure that training is being observed.

Never click on email attachments or links from unknown sources: They could have malware embedded in them.

Steps for responding to a ransomware attack

Activate the incident response and business continuity teams: Gather your company’s incident response and business continuity teams. Ensure each participant (IT, management, PR, legal, and any others) know what their role is and are standing at the ready.

Get help from the experts: Report the attack to the appropriate cyber law enforcement authorities as soon as you know you’ve been hit. You can also contact third-party experts to assist you in your recovery efforts.

Determine the scope of the incident:

• Identify the ransomware variant causing the infection.
• Confirm when the infection began.
• Note which networks, devices, applications, and systems have been affected.
• Determine how quickly the malware is spreading.

Contain the spread:

• Remove the infected devices and systems from the network (both wired and Wi-Fi) and from external storage devices.
• Take extreme caution with any remaining devices connected to your network and external storage devices.

Determine how you will recover from the infection.

• Try to remove the malware, or to wipe the infected system(s) and reinstall everything from scratch.
• Hire a private company to help with your recovery efforts

Remove the malware and recover your systems.

• Try to restore from a safe backup or backups. It’s best to use a backup that was not connected to your network at the time of the attack.
• Reinstall your operating system and software applications from their source media or the internet.

Plan to prevent a future ransomware infection.

• Investigate how the attack occurred, then put appropriate measures into place to prevent future infections from occurring e.g:
  
• Conduct regular staff cybersecurity awareness training, including phishing prevention.
• Configure strong spam filters and utilise authentication email technologies.
• Implement a good backup policy that uses both local and off-site backups.
• Identify and resolve any system vulnerabilities. Conducting regular penetration testing can help you identify and quickly address any potential gaps.
• Enable mandatory multi-factor authentication to reduce the risk of unauthorised access.