According to the latest estimates from Cybersecurity Ventures, ransomware is likely to cost $10.5 trillion annually by 202The frequency of attacks is set to rise significantly, with an attack likely to occur every 2 seconds by 2031. The risk is disproportionately large for small-to-midsized businesses where ransom demands regularly reach seven or even eight figures. The highest ransom till date is reported as $40 million (USD), by CNA Financial, in May 2021.
Recent survey data shows us that nearly 40% of MSPs and IT professionals believe their organization is unlikely to be able to withstand $500,000 or more in ransomware damages. This is in concurrence with the latest reported facts, where 52% of businesses that suffered a ransomware attack are reported to have experienced losses of over $500,000. It is not uncommon to find companies willing to shell out millions of dollars to decrypt their data once it’s taken, hostage. However, this trend only encourages more attacks as Ransomware 2.0 claws its way into the world with professionally-run oligarchic business models.
While paying is never recommended (and is actively discouraged by the FBI), there are several essential steps that you can take to protect your business from ransomware attacks. For more information, please refer to IT security Vancouver
Ransomware attacks can start in several ways. One of the most common is phishing: an attacker sends the victim an email that appears to come from a trusted source, which may contain an attachment or link to a website that installs malware on the user’s computer. Spear phishing targets specific individuals and may require extensive research by the attacker before targeting the person with a malicious email or link; ransomware criminals typically try to compromise systems in bulk. But recently, we’ve seen attacks against more valuable victims—more significant, valuable targets (with correspondingly bigger payouts).
These larger, more valuable targets merit the investment in research. It’s also possible for an attack to start when a victim visits a legitimate but compromised website. In some cases, an attack can start without any action by the victim: some ransomware can spread directly from computer to computer via SMB networks or other vulnerabilities. One recent attack started through a supply chain compromise: attackers planted malware in an enterprise security product and then distributed it unwittingly to customers.
It’s a simple rule, but you’d be amazed how many people ignore the primary step to not click on unsafe links. Ransomware attacks often start with a phishing email or a malicious link in social media, chat messages, text messages, or web search results. The message may look like it came from someone you know or trust (like your bank or utility company). It’s best to avoid being trapped by building the habit of always hovering over links to check their authenticity before deciding to click on them. If something seems off about the email or the link—if it doesn’t use proper grammar or spelling—then delete it and report the sender to the service provider.
If someone requests your name, address, phone number, email address, or social security number over the phone or via email and claims the information is needed for verification purposes (or any other reason), don’t give any information away without confirming the request first through another channel. Remember never to share those details over phone calls. The same goes for online payments—don’t pay anyone who contacts you asking for payment via unusual channels such as social media messaging apps like WhatsApp because there are no guarantees these methods are secure enough to protect your data from criminals looking to harvest sensitive info.
If you have been contacted by a company asking for personal information, don’t provide it unless you are sure it is safe to do so. Call back the official helpline number of the organization (such as a bank) and double-check the authenticity. The same holds for family members’ names and addresses. This information can be used to steal your identity and commit fraud in your name.
If you receive an email from a bank asking you to verify your account details by clicking on a link within the message body, delete the message immediately! Hackers worldwide have used this technique to trick unsuspecting users into providing their banking credentials to gain access to online banking accounts and drain them out of money—and sometimes even lock users out of their accounts until they pay. Up-front fees to regain access!
A fundamental rule of thumb is to never open email attachments from unknown senders or email attachments you are not expecting. Ever.
If you receive an unexpected email attachment, do not open it. If you receive an expected email attachment but suspect it may be infected with malware, do not open it until you have run a virus scan on your computer and made sure there are no threats present on your system.
If a friend forwards you an attachment they know has been sent to them by someone else they trust, then maybe consider opening the attachment if you feel comfortable doing so. However, if this person isn’t close enough for their name to ring any bells in your head when reading their name at the top of the email header (especially if this person isn’t someone in your contact list), then don’t take any chances!
This rule also applies to attachments sent via social media platforms such as Facebook Messenger or WhatsApp. Don’t trust links given by unknown contacts unless they come from people who have already been verified by these services (i.e., friends).
Ransomware is often spread through USB drives. If you don’t know where a USB stick came from, don’t use it—it could have been infected by ransomware. If you’re using a USB stick given to you by someone else, make sure they are trustworthy and reputable before using it.
Keeping your programs and operating system up to date is one of the easiest things you can do to prevent ransomware attacks. As new software versions are released, they often contain security fixes that close loopholes used in previous versions by hackers. Updates can also add additional functionality or improve performance. Updating your programs and OS is often completely free and only takes a moment or two—you don’t even have to restart the computer! For vast and complicated office networks, opting for a managed service provider like IT Support Vancouver for timely updates and patches is the best solution.
You may think using the free or latest version of your favorite software is the best way to stay secure, but it could get you in trouble. Some programs are known malware distributors, and many more have been hacked in their history. Sticking with established sites as much as possible when downloading programs or updates is better.
If you must download from an untrusted source—for example, if your computer manufacturer no longer provides support for your machine—make sure that you only download from trusted sources and use common sense when installing the file onto your system.
A virtual private network (VPN) is essential, especially when using public Wi-Fi networks. A VPN encrypts your data and protects it from being intercepted. It also hides your IP address by connecting you through another computer – known as a server – so that the person or company providing the public Wi-Fi won’t be able to track you.
If you’re using your phone, tablet, or iPad while at home, then use the VPN on these devices. The same goes for any computer that isn’t connected directly via Ethernet cable; if there’s an option to connect wirelessly, turn on the VPN for that device too! Managed IT Services Vancouver can guide you to the best VPN service, depending on your needs.
