Despite a slight decline in ransomware attacks in 2018, these malicious incidents continue to pose significant risks in the cybersecurity landscape. Recently, the prominence of ransomware reached mainstream media, with a feature on 60 Minutes highlighting three major instances of ransomware attacks affecting municipalities and a hospital.
In these cases, the attackers utilized sophisticated techniques to encrypt all files and even some backup files, leaving the organizations in dire straits and resorting to manual operations on pen and paper. While two of the entities decided to pay the ransom, one opted to undertake remediation independently. The cost of the ransom varied, with the hospital facing a $55,000 bill, one municipality negotiating payment down to $8,000, and the other entity incurring millions of dollars in losses, with some data remaining irrecoverable.
While the 60 Minutes story offered valuable insights into the perils of ransomware, it did present two misleading aspects. Firstly, the incidents covered were seemingly confined to major entities, implying that smaller organizations were not at risk. In reality, nearly 50% of small business owners reported experiencing a cybersecurity attack within the past year. Thus, ransomware affects organizations of all sizes, not just high-profile ones.
Secondly, the story suggested that paying the ransom was often the more cost-effective and quicker solution. However, succumbing to ransom demands should be considered a last resort. Relying on the integrity of cybercriminals who have already demonstrated malicious intent is precarious. Instead, proactive prevention measures are recommended. This includes maintaining robust backups with an on-premises and multi-tenant off-site solution to facilitate data restoration. While some data loss may occur during recovery, it pales in comparison to the financial burden of paying a substantial ransom.
Prevention is further reinforced through employee training to identify and thwart phishing attempts and monitoring data flow in and out of the network diligently. Isolation of critical applications on separate networks enhances global network safety, ensuring that a ransomware breach doesn’t compromise all valuable data at once.
While ransomware attacks may have somewhat subsided, the threat remains ever-present, prompting hackers to explore new avenues for scamming organizations. Therefore, it is imperative for businesses to stay vigilant and prepared. By implementing effective preventive measures and being resilient against ransom demands, organizations can safeguard their operations and data integrity from this persistent threat.
