What is Ransomware

Ransomware is a type of malware used by threat actors to infect computers and encrypt computer files, until a ransom is paid. After the initial infection, ransomware will attempt to spread to connected systems, including shared storage drives and other accessible computers making it difficult to stop.

If the threat actor’s ransom demands are not met (in most cases meaning the victim does not pay), the files or encrypted data will usually remain encrypted and unavailable to the victim. Even after a ransom has been paid it is not guaranteed that the threat actors will unlock encrypted files. In fact, most threat actors will sometimes demand additional payments, delete a victim’s data, refuse to decrypt the data, or decline to provide a working decryption key to restore the victim’s access.

Therefore, it is suggested to not pay the ransom and find other means for recovering lost data. It is always better to prevent an infection than resolve an infection and, in this blog, we go over a couple of tips to prevent a ransomware attack.

How to prevent a ransomware attack

Never click on unsafe links: Avoid clicking on links in spam email messages or on unknown websites. If you click on malicious links, an automatic download could be started, which could lead to your computer being infected. It is good protocol practice to make sure that you are aware of the links that you are clicking. There are also tools that your IT department can implement such as content scanning or monitoring that will help to prevent you from opening links without certain access. Always report suspicious links to your IT department to prevent further misuse and vulnerabilities.

Avoid disclosing personal information: If you receive a call, text message, or email from an untrusted source requesting personal information, do not reply. Cybercriminals who are planning a ransomware attack might try to collect personal information in advance, which is then used to tailor phishing messages specifically to you. If in any doubt as to whether the message is legitimate, contact the sender directly.

Use and maintain reputable antivirus software and a firewall: Maintaining a strong firewall and keeping your security software up to date is critical in preventing malicious attacks. Another suggestion is moving your systems to the cloud. The main advantage of cloud instances versus on-premises systems is cloud-based architectures are more difficult to exploit. There are several safeguards in place to prevent vulnerabilities inherited by being in the cloud. In addition, cloud storage solutions allow you to restore older versions of your files. This means that if the files are encrypted by ransomware, you are able to return to an unencrypted version using cloud storage.

Keep your programs and operating system up to date: Regularly updating programs and operating systems helps to protect you from malware. When performing updates, make sure you benefit from the latest security patches. Maintaining current security patches and protocols makes it much more difficult for threat actors to exploit vulnerabilities in your programs and systems.

Conclusion

As with other forms of malware, careful action and the use of excellent security software are a step in the right direction when it comes to combatting ransomware. It is incredibly important that you keep your employees trained to avoid easy exploits, have a backup system, and monitor/keep programs up to date. If a ransomware attack happens to your company, it is suggested to not pay the ransom and instead try and isolate the environment as quickly as possible. Then look to employ backup solutions.