Businesses of any size can fall victim to ransomware. How will you protect your small business from it? And can you afford it?
The Business of Chicago
One Monday morning, 35 workers of a Chicago business board of directors turned on their computers. They were met by a desiccated head popping up and demanding nearly a quarter-million in Bitcoin. Hackers had shut off their internet access. Their databases had been scrambled and rendered unusable.
This NGO had vital infrastructure but no skilled cybersecurity professionals or even a proper data recovery and business continuity strategy, much like thousands of other ransomware victims whose tales never reach the news.
Company management believed that its data and networks were secure until they experienced that dreadful Monday morning return to work. The company also lacked the financial wherewithal to pay the ransom.
Productivity loss is the biggest price tag paid by ransomware victims. In addition, they suffered the time-consuming job of controlling and cleaning up after the assault.
According to Proofpoint and the Ponemon Institute study, a ransom payment generally amounts to less than 20% of the entire cost of a ransomware attack’s interruption.
The staff at the Chicago organization discovered too late that their data recovery methods did not actually back them up. The organization labored over finding paper documents in order to recreate its records from the ground up.
Businesses In a Bind
Many smaller businesses believe they aren’t vulnerable to ransomware. That is very clearly not the case.
According to the National Cyber Security Alliance, small and midsized firms are the target of the bulk of cyberattacks, with up to 60% of them going out of business within six months of the ransomware assault.
Three Simple Steps to Defeat Hackers
Some may reasonably question, if a $44 billion firm like Accenture can fall prey to ransomware, what hope does a smaller company have?
Everyone requires a reaction plan if no one is immune to an assault. Consider the following three essential steps:
1. Provide cyber awareness training to all staff.
PEBCAC stands for “problem exists between computer and chair” in the world of cybersecurity.
Because email phishing is by far the most common threat vector for ransomware, the first line of defense is to teach all employees not to open unfamiliar attachments or clickbait links — “You’ve just won $1 million!” — and to protect their login credentials, preferably with two-factor authentication.
Some employees, believe it or not, still retain passwords on Post-it Notes stuck to their computer displays. Every employee in today’s networked remote workforce is a member of the security apparatus. Employees play an essential role in data protection. However, they must be given the correct knowledge and training.
2. Update all of your applications.
An inventory of operating systems and software is the first step in any threat assessment.
Updates defend a computer network from known security flaws. Additionally, you must properly maintain and configure every firewall and server to stay safe.
Unfortunately, this seemingly simple task of data governance is a big undertaking. It’s made considerably more difficult by the abundance of endpoints. Think smartphones, industrial systems, IoT devices, and all the equipment used by work-from-home staff.
3. Put backups and recovery strategies to the test.
This is the one step that many companies skip. You shouldn’t.
Pick a day, perhaps a Saturday, when everyone “pretends” to be victimized by a hacker. Test the reliability of your backups and the amount of downtime you can expect to endure should you fall victim to ransomware.
How You Can Recover
To recover from an assault, every firm needs dependable backups and, equally essential, a business continuity strategy. Form a cyber incident response team and conduct penetration testing to ensure the safeguarding of vital infrastructure. Be proactive rather than reactive in your cyber response.
No one is immune to assault. These are merely the beginning of your defenses.
Monitor network traffic in real-time. Otherwise, your organization is extremely susceptible. Mechanisms must be in place to detect and respond to intrusions before you suffer damage. Be aware that 100 percent prevention is neither cost-effective nor practical.
Virus Software
Virus software and firewall hardware have come a long way. However, at the end of the day, the greatest defense is a skilled cybersecurity team.
A monitoring and incident response control center will allow speedy data recovery, reducing downtime for both internal and external cyberattacks. Outsourcing a security operations center may help businesses with limited resources reduce their risk.
Consider the cost of business disruption as the first step in making systems more robust. Governments, utilities, and even IT corporations are all vulnerable to assault. Put a solid data security strategy in place. Without one, it’s not a question of if, but rather when hacking will occur.
Make sure your cloud storage is secure. It’s imperative that you do so ASAP. Without this safeguard, all sorts of malware, such as ransomware, can run riot through your systems.
