Ransomware is a type of malware that prevents or limits users from accessing their system—either by locking the system's screen or by locking the user’s files—unless a ransom is paid. Suppose, for example, that Michael in Finance receives an email that looks like it’s from Human Resources (HR) with a subject line that reads “2016 Health Insurance Options.” How do you train Michael and the rest of your staff not to open the attached document? Awareness is the first line of defense when it comes to preventing ransomware attacks but it’s not foolproof.
Follow These 4 Golden Ransomware Prevention Rules
How do you protect your organization against ransomware? The four golden rules to regulate information sharing are:
- Perform regular patching of updates and backups to an external source such as a hard drive or secure cloud site.
- Always disconnect your drive after backing up to prevent ransomware from encrypting your backup source.
- Never open emails in your spam folder or from people you don’t know. And never open attachments in emails from unknown sources.
- Use a legitimate, trusted antivirus software solution and keep the virus definitions updated daily.
If You Are Attacked ...
Never pay the ransom, regardless of the amount. Doing so can make the situation worse and will not improve the likelihood of retrieving your data. Simply take heart in the fact that you’ve performed and tested your backups! If your organization has been the victim of a ransomware attack, you should:
- Disconnect the compromised machine(s) from the network immediately.
- Call a cybersecurity professional to help retrieve your data and secure your environment to prevent further attacks.
- With the help of a trained cybersecurity professional, determine whether it's necessary to contact your local authorities.
Prevention Is Your Best Defense
An ounce of prevention is worth a terabyte of cure. As mentioned earlier, a well-trained staff is your first line of defense. The investment associated with training your staff is a small price to pay when compared to the potential cost of brand damage and the loss of irretrievable data. At Security Pursuit, we recognize that even the best security control implementations aren’t enough, especially if your staff isn’t aware of threats and risks. We offer live training and eLearning courses to educate through security awareness programs. Contact us to learn more about training programs for your organization.