My Guest Blogger John Ansbach is General Counsel of General Datatech, L.P. (“GDT”), and John is a seasoned attorney with a broad range of experience developed over more than 18 years of practicing law including as a corporate generalist, his background includes experience in contracts; cyberlaw; intellectual property; real estate; human resources; corporate governance; regulatory and compliance; and, litigation. He’s also developed experience as a legislative advocate and technologist, advocating for GDT and its industry partners in areas relating to cloud and cybersecurity, the Internet of Things (IoT), tax policy and patent reform.
Well, the results are in and we have a winner…ransomware wins first place for the top global cybersecurity threat of 2016.
According to a recent report by cybersecurity company SonicWall, ransomware attacks (malware that prevents or limits users from accessing their system or data unless a ransom is paid) soared in 2016, up 167 times the number recorded in 2015. (Source: Computerworld, “Ransomware soars in 2016, while malware declines,” by Matt Hamblen, February 7, 2017, citing the SonicWall report). “Ransomware attacks rose from 3.8 million in 2015 to 638 million in 2016…SonicWall theorized that ransomware was easier to obtain in 2016 and that criminals faced a low risk of getting caught or punished…Ransomware was the ‘payload of choice for malicious email campaigns and exploits,’ SonicWall said.” (Source: Id).
“…ransomware attacks soared, up 167 times the number recorded in 2015.”
The report concluded that in 2016, “the most popular malicious email campaigns were based on ransomware [ ] which was deployed in more than 500 million total attacks throughout the year.” It also indicated that, “No industry was spared: the mechanical and industrial engineering industry got 15% of the ransomware hits, while pharmaceuticals and financial services companies each got 13%, while real estate companies got 12%.” (Source: Id.).
So, if you are a business leader in one of these (or any other) sectors, what can you do to resist the onslaught of ransomware cyberattacks? Focus on prevention. “Most security experts agree that it is almost impossible to recover data that might have been encrypted in a ransomware attack without access to the decryption keys, or to a backup copy of the affected data. So the focus has to be on prevention.” (Source: DARKReading, “Here’s How To Protect Against A Ransomware Attack,” by Jai Vijayan, February 4, 2016).
According to experts, there are a good number of actions (technical and non technical) leaders can take to prevent ransomware. Here are my top three:
- Have Backup. “Having a robust data backup process can go a long way in blunting the threat posed by ransomware. In fact, it is often the only way to recover data if you are unwilling to pay the ransom demanded by an extortionist.” (Source: Id.)
“Recovering data encrypted by a ransomware attack is next to impossible, so prevention offers the better approach.”
- Develop a Response Plan. “Time is critical for an organization faced with a ransomware deadline. Online extortionists typically give organizations a very specific time limit within which to pay…They deliberately don’t give enough time for an organization to figure out if it can try and unlock the data without paying any ransom. So it is important to have a plan in place describing what needs to happen in the event of a ransomware attack. ‘The last thing you want is to be doing a Google search for a local forensics experts at 2am on a Saturday morning.’” (Source: Id.)
- Train (Test and Re-Train) Employees. There may be no better non-technical defense against ransomware than training and empowering employees to recognize and resist emails used to deliver ransomware malware. But ‘train, fire and forget’ won’t cut it. “Raising awareness about ransomware by educating staff about the dangers of clicking on attachments or links in emails is clearly important as a baseline security measure. But it only takes one employee to lower their guard on one occasion for an organization to be compromised…companies such as PhishMe provide technology to help keep employees on their toes by sending them simulated malicious emails on an ongoing basis; if an employee clicks on a simulated malicious link, they get feedback to help ensure that they don’t fall victim to a similar email again.” (Source: eSecurity Planet, “How to Stop Ransomware,” by Paul Rubens, January 31, 2017).
Ransomware has clearly been the chief cyberthreat for business in the last year, and if the first month or so of 2017 is any indication, this year will be no different. (See, “Ransomware expected to dominate in 2017,” ComputerWeekly.com, by Warwick Ashford January 6, 2017). Business leaders will have to face the ransomware cybersecurity threat head on, and do so deliberately, methodically and purposefully. Only by taking this threat seriously, and preparing a business and its employees accordingly, will leaders prevail in this fight. And only then, when an organization can access and protect its information and that of its customers, will leaders be able to focus on the myriad of other day-to-day efforts to make their business truly great.
For a more complete list of action items and methods that can be used to combat and resist ransomware, both technical and non-technical, check out the DARKReading.com article, as well as the eSecurity Planet article.