Ransomware at Play

[noelward]

Ransomware at Play

By Noel Ward, Editor@Large

The bad guy penetrated your computer system while you were sleeping. His ransomware landed while you were driving to work, locking up your files, which are inaccessible behind his encryption. Now you’re having a bad day before your second cup of coffee.

Since you are probably receiving a few files electronically your email is open to the world. This means all kinds of bad guys can rain on your parade. A favorite ploy is ransomware, in which you can’t access your files without paying the bad guy for access. Ransomware has also gotten sophisticated. Dwell time (how long a bad guy waits to wreck your day) is now hours, not days like it used to be. Imagine a customer has sent you the layout for a catalog and mail piece. It came in electronically on Friday, just before you closed and it is not backed up. This morning you get an email explaining that you can get the now-encrypted file back for a mere $50K. Call me crazy, but that might be an awkward to call your client. Even if you convince your client that the file was inadvertently deleted you lose a lot of credibility, plus the client may walk and not come back.

To further wreck your morning the bad guy also encrypted all your hard drives or set a time bomb to lock them up in the next time one of the computers on your network is restarted. That would lock up all your customer files and your accounting, which you have carefully placed on a separate drive. Unlocking that will run a paltry $750K. How’s your checkbook looking?

Such hacks are cheap on the Dark Web and the payback can be substantial. You’re just someone’s next victim. Fifty-three other companies are receiving emails much like yours.

To pay or not to pay
Don’t pay up, security experts recommend, because it only encourages the bad guys. Since these characters often share info about their “targets,” the fact that you paid up may bring another miscreant to your servers. Like this: “I got a cool 800-Large from DEF Printing. They folded in a nano. Install that encryption we got off the Dark Web and send ‘em a note. Or text ‘em. Here’s the main dude’s cell number.”

Instead of paying up, do some things to make their life harder so you lessen the chances of being hacked. You cannot make your business impervious. But being lazy the bad guys will move on to a softer target. Start by hiring a security firm do a penetration test (called a pen test) on your systems to find out how vulnerable you really are. You may not like the answer. However, there is no one-and-done solution because cyber security is a constantly moving target. So you have to do more. Here’s a partial list:

• Have updated software that is designed to protect data
• Limit how many files are accessible at any time.
• Get cyber insurance. Insurers will insist on the above steps. Some companies that thought cyber insurance was too expensive aren’t around anymore. Others I’ve talked with say they would have gone under without the insurance.
• Have a contract set up in advance with an internet security company so you have someone to call who knows how to deal with this stuff.
• Have a written plan that plan that is updated regularly and resides places other than the bottom drawer of peoples’ desks.
• Have people on staff to handle a security breach as part of their assigned responsibilities. Someone, such as your equivalent of a Chief Information Officer, should be in charge of this team.
• Work with your security vendors and the internal team to game out the steps to take when reacting to an incident or intrusion. Your security vendor will have advice on this. Listen!
• Roll out your security team and practice response to a hostile event a couple times a year so you are better prepared.
• The cost to your business is not limited to the intrusion and lost work. There are also legal costs, business that may leave, and your reputation in the business community. Insurance cannot and will not cover some of this.
• Establishing and maintaining trust with clients during and after a security breach is critical.
• Document what happened and what your company did so you have a record.

Don’t assume you are immune because you are a “mere” printer. You are reliant on software and digital files and communications. While guys who can hack a Fortune 500 company are not exactly common, the ones who can lock up your servers probably attend your local high school and peruse the Dark Web. Some may note the pricey company cars in your parking lot, know where you live, and see a financial gain. Okay, maybe high school kids won’t charge full price, but do you really think a cyber breach is going to be fun?

It’s okay to be paranoid. Someone may be out to get you.

 

[Hulign]

"It’s okay to be paranoid. Someone may be out to get you." Great line!

 

[ReproElectroProspero]

Your advice is great for a large company, but kind of overkill for most of us. I would wager the majority of our compatriots do not have anything remotely close to a Chief Information Officer or equivalent. We won't have security vendors other than the default Microsoft Defender. They won't have a security team, contracts with an MSP, or anything close to that. The majority of us are gonna have worker bees, managers, and the owners.

Managers should, at the very least, ensure that all business data is backed up in multiple places at least once per month. Ideally daily or weekly though. The common advice is the 3-2-1 method. This means making two copies of your data (the original copies then make it 3 total copies). Those copies should be stored in 2 different ways. Like, on an external hard drive and in the cloud. Then, at least 1 of those should be stored disconnected from the internet and offsite.

This ensures you can recover if your building burns down, you get ransomwared, or your local copies all get deleted by an angry employee. It protects you against multiple modes of failure.

It's quite the easy strategy to implement, it astounds me how little management actually does it though.

 

[noelward]

You're right, you don't need a Chief Info Officer. All the important stuff can be done by yourself and by, as you seem to, having some good rules. I backup once a week to the cloud and an external drive that lives in a safe. All is encrypted. Some stuff backs up automatically all the time.

BTW, Microsoft Defender is becoming a pay-to-play service. I still use a double VPN and my IT-pro pal has convinced me to get a password manager. And I still do the back-up and two flavors of storage, especially when I travel.

I too am amazed by how biz owners assume it can't happen the them. I colleague insisted he was fine. Then the wolf came to his door. He had an unpleasant (and pricey) fee days.

None of it is really hard but it takes some diligence and effort. But many people want it all to be automatic. Fine, but bring money.