How to Protect Your Organization From Ransomware Attacks
Ransomware is malware that, once on a device, encrypts the victim’s files and then demands payment to restore them. Victims are typically given a limited time to pay the ransom or lose their data forever. Attackers use phishing emails and other social engineering techniques to infect devices, then spread across the network via malware attachments or compromised websites.
Once ransomware has gained access to a system, it begins searching for and encrypting files and may search for backup and shadow copies to delete or corrupt. Once all of the victim’s files have been encrypted, attackers display a screen informing them that they need to pay a fee to regain access to their data.
Attackers primarily target industries where disruptions can yield the highest financial gains. This includes education, healthcare, government and manufacturing. Attacks have become increasingly sophisticated, as organized criminal gangs have jumped in to exploit the COVID-19 pandemic to scale their operations and develop newer, more effective ransomware variants.
When a ransomware attack does occur, organizations must respond quickly to isolate the attack, identify and recover compromised data, and communicate with affected victims and the public. Depending on the nature of the breach, organizations must also comply with regulatory requirements such as HIPAA. This requires isolating infected systems, disconnecting from networks and locking shared drives to prevent spread. It’s also important to know what strain of ransomware was targeted and whether any decryptor tools are available. And, it’s a good idea to contact law enforcement after an attack, because ransomware is a crime and reporting incidents to the FBI can help them locate the attackers.