Ransomware attacks – just in case you have forgotten that any organisation can be compromised – three tips to help you face up to the threat

Bored with ransomware stories? Read this one, it has a very nice Hitchhiker’s Guide to the Galaxy reference.

There have been a flurry of ransomware attacks in the news recently – but these are only the ones that make the headlines.

Louisiana authorities investigating ransomware attack on city of Alexandria – The Record by Recorded Future

Foxconn: Mexico factory operations ‘gradually returning to normal’ after ransomware attack – The Record by Recorded Future

Costa Rican Social Security Fund hit with ransomware attack – The Record by Recorded Future

Research shows there are many other businesses, organisations and individuals that do not make the news when they accidentally activate the ransomware malware on opening a Word document, looking at a PDF emailed to them by the tax office, or following a link .

Those people have to rely on their cyber security planning, incident response plan and back-ups.

You could of course, get some insurance and get that to pay the criminals who are holding your business to ransom:

Healthcare faces rising ransomware attacks and is paying up • The Register

However there are three problems with paying up:

• 1 You are dealing with criminals – never a good look for any organisation – and who is to say they will stick to their side of the bargain and give you the correct keys to recover all your stuff after they have your money?
• 2 It makes things bad for the rest of us. If the cyber gangs continually, successfully make money from ransomware they will carry on trying to infect anyone, just to see who will pay up. Maybe that will not bother you, as it is a “SEP”, somebody else’s problem, but it should as…
• 3 The most successful cyber gangs are organising themselves along the lines of conventional businesses, so they pursue those activities that make them the most money, they do not waste effort. Why go looking for new targets, that may be prepared with cyber security plans, good training, incident response role plays and effective back-ups – such targets are difficult to infect and when infected are not going to pay up. You, on the other hand, have proven you are weak when it comes to cyber security and have the means and the willingness to pay when infected. They will be back!

What can you do right now?

Training

Train your people to recognise phishing emails and social engineering attacks. Email is the key attack vector for most malware to get into an organisation.

Of the 39% of UK businesses who identified an attack, the most common threat vector was phishing attempts (83%).

Cyber Security Breaches Survey 2022 – GOV.UK (www.gov.uk)

If you can tighten your control of how your people deal with their email, then you will have taken a positive step to improving your cyber security.

However at Smart Thinking we understand that one size does not fit all, so over time we have developed a range of ways for organisations to access our Phishing Email and Social Engineering Training. Follow the link and see what your options are:

Social Engineering and Email Cyber Security Training – Octagon Technology

We also have a new specialist online training option, that I developed and wrote, which includes online tests, at CyberAwake. This option is great for companies that have a larger workforce or may be spread out across the country. You might also see this being offered by other IT companies as we have a number of affiliates using the service with their clients.

Cyber Awake | Train Your Team To Protect Against Cyber Attacks

Back-ups

When all your company information is encrypted and your operation is paralysed, do not expect anyone to be able to help you if you do not have the latest type of ransomware effective data back-up.

Now you know what a back-up has to be, to protect your information from ransomware and other data loss issues, go right now and check your back-ups are up to standard and cover everything. The team at Octagon has helped many clients through a ransomware attack, using our back-up solutions and our experience of helping clients through whatever IT crisis they face.

Have a plan!

Incident response plan, business continuity plan, call it whatever you want, but have a plan. We are actively helping organisations create the types of plans needed to not only cope with ransomware (we have an excellent Ransomware playbook, that is based on the internationally recognised COBIT standard) but other cyber security risks, such as; trust and identity, device loss and insider threat.

Write your own or get help – but have a plan.

There are obviously more than three steps to better cyber security

But this is just a blog to make you think about what I think are the three immediate things you should do to combat cybersecurity threats.

Further Reading

Cyber Security Breaches Survey 2022 – GOV.UK (www.gov.uk)