Faced with the threat of business operations being suspended, many companies will in fact cough up should they become the target of ransomware.
Research from Palo Alto Networks’ Unit 42 suggests that as many as 58 percent of organisations targeted by ransomware, pay the ransom.
While the temptation to pay a ransom and get your data back is immense, actually coughing up is a bad idea. This is according to global security strategist and researcher at Fortinet, Aamir Lakhani.
“While I appreciate that some organizations may have no option but to pay ransomware attackers, I recommend not doing so unless you absolutely must take the risk because if you don’t your business is guaranteed to fail,” says Lakhani.
Why is this the prevailing advice from not only Lakhani but most in the infosec space?
For one, word gets around. Should an attacker launch a ransomware attack on your company and then pay, others could learn of this and your company could suddenly be inundated with attacks.
That’s even assuming that once the ransom is paid, the attacker will provide the decryption key.
As such, having a plan in place in the event of any cybercrime incident is something every business needs.
“Organizations can limit the ransomware’s impact by taking quick action. First you must isolate the ransomware. This can prevent horizonal attacks, where the ransomware spreads from one device to another via network connections. To isolate the ransomware, you must shut down the infected system. Then disconnect anything that links the infected machine to the network or other devices on the network,” Lakhani explains.
We should point out that this may not always be possible but through proper segmentation of a network, ransomware can be cut off before it gets out of hand.
One of the best ways to get around ransomware is having a strong data recovery programme.
“If backups are scheduled for several times a day, a ransomware attack might only cost your organization a few hours. Whether you use cloud services or on-premises hardware to make copies of your data, it doesn’t matter. You just need to be able to access the backup files from an unaffected device,” says Lakhani.
Below, Lakhani has shared actions firms should incorporate into their cybersecurity strategy:
- Take cybersecurity training seriously and encourage employees to do so as well
- Avoid clicking on suspicious links and practice good cyber awareness
- Download only from trusted sources
- Scan emails for malware
- Employ firewalls and endpoint security products that are integrated with actionable threat intelligence
- Back up important data
- Use a VPN when on public Wi-Fi
- Have an incident response plan in place
