Ransomware continues to be a growing threat against both individuals and businesses. More than 200,000 organisations in the US experienced ransomware attacks in 2019 alone, a 41% increase from 2018. Attacks have become increasingly diversified and sophisticated, targeting organisations and businesses of all sizes.
Ransomware is a type of malicious software that compromises a user’s device, encrypts and blocks the user from accessing their files and then demands a ransom in exchange for restoring the files. Traditional forms of ransomware simply encrypt files, while more modern variants go one step further by also transferring potentially sensitive data to the attackers, who then threaten to release them.
Preventing ransomware attacks is no longer as simple as just avoiding suspicious email attachments and installing antivirus software. Threat actors have been increasingly successful at exploiting organisations through phishing, social engineering, and exploiting unpatched or zero-day software vulnerabilities.
Establishing security awareness and systematic planning
Though ransomware attacks pose an existential threat to businesses, more often than not, little is done to protect against them. Fortunately, there are some easy ways to mitigate risks.
1. Block and monitor
IT teams are the first line of defense against ransomware and can block many attacks before they reach end users or critical systems. Modern security practices leverage multiple "layers" of protection. Starting at the outermost layer, using a well-configured firewall and Intrusion Detection/Protection System (IDS/IPS) can help block large portions of low-level attacks. Additional network monitoring and analysis tools can then be set up to check for unusual and suspicious traffic patterns, with containment plans in place should the need arise.
2. Stay up to date
On endpoints and servers, IT should ensure that deployed software, operating systems, and anti-malware solutions are up-to-date. Additionally, user accounts should be well thought out, with each account configured to only allow access to what that user needs and nothing more. The same concept applies to system administrator accounts; avoid using a single account that has access to everything. Partitioning access to different systems and minimising access to only what is needed can help drastically reduce the damage inflicted if credentials are leaked.
3. Educate employees
Maintaining good security also requires all end users to be well-educated on potential threats, as many breaches have been caused by users falling prey to phishing and social engineering tactics. Training programs should be in place to provide examples of modern phishing attacks and how social engineering can happen. Additional best-practice knowledge should be shared on handling suspicious emails, identifying spoofed websites, and most importantly, how to report a security incident.
4. Plan, practice and be prepared
Crisis management plans should be well documented and rehearsed. For example, who should handle communications, internally and externally? What processes will be used to conduct auditing, damage analysis, and customer and authority notification, should the need arise? Internally, IT should always maintain up-to-date deployment maps of which systems are doing what, and which are dependent on one-another. Contingency plans should be in place should a total site shutdown be required to contain and/or remove the malware.
Set up multi-version, offsite backups and real-time recovery mechanisms
While employee education and IT teams can mitigate ransomware attacks to a large extent, due to the unpredictable nature of attacks, systems can never be 100% protected.
The only fail-safe way to completely protect digital assets is to have a comprehensive backup strategy in place from the start. This will ensure that if systems are compromised, there will always be a clean version of data to recover from.
One popular backup methodology is the 3-2-1 backup strategy. Simply put, this is 3 copies of your data, across 2 different mediums, with 1 copy offsite. An example of this could be storing your data on an on-premise server, with two backups, one on-site and another located on the cloud or at a remote site.
To take a real-world case as an example, network-attached storage company Synology successfully helped a government entity to streamline and backup large-scale content creation projects produced by its subsidiary render farm. With 300 virtual machines (VMs) running multiple tasks, the render farm ultimately leverages Synology’s Active Backup for Business to back up its running VMs onto another onsite Synology NAS, while utilizing Snapshot Replication and Hyper Backup to automate additional onsite and remote backup tasks. With this structure in place, the rendering farm can preserve multiple data backups at both onsite and offsite locations, drastically mitigating the risk of data loss.
There are many more success stories where clients utilise Synology solutions to build their information security and backup strategies. In an era of ever-evolving ransomware, Synology believes that proactively backing up files regularly is a critical step in protecting important business data and preserving digital assets.
To learn more about the benefits of backing up with NAS, click here to visit the Synology website.
For more information about securing your business from ransomware, register for the free Synology webinar: Protect against and recover from ransomware
