Ransomware

What is ransomware?

Ransomware is a type of malicious software (malware) that encrypts the victim's data. The attacker then demands a ransom from the victim to decrypt the files and return them.

Ransomware attacks often start with a phishing attack, where the attacker uses various forms of social engineering to trick the victim into clicking on a link.

A typical example is an email warning the victim about an important and time-sensitive issue, urging them to click on a link to resolve it before time runs out. The attacker often uses strong emotions like fear, curiosity, or urgency to prompt the victim to act quickly.

A ransomware attack can encrypt a variety of systems, including computers, servers, networks, applications, and email systems. This can make critical services and functions unavailable, which can have serious consequences for both public and private organizations.

Countermeasures

Backups: Regularly back up your data to ensure you don't lose it permanently. This can include automated backups and storage in a secure location.
Security training: Regularly train employees in good security practices to prevent attacks. This includes recognizing threats and knowing how to respond to them.
Secure email practices: Use email filters and alerts to reduce the risk of phishing attacks. Good email filters can lower the likelihood of employees receiving scam emails.
Access control: Limit access to sensitive data and systems to only those who need it to perform their job duties. This helps minimize the risk of unauthorized access.
Multi-factor authentication (MFA): Use MFA for extra security, making it harder for an attacker to access your data. This adds an extra layer of protection.
Security software updates: Ensure you have the latest security updates installed and use reliable security software. This reduces vulnerabilities that attackers can exploit and protects against threats.
Firewalls: Implement firewalls to control incoming and outgoing network traffic and protect against unauthorized connections. This helps keep your network secure.
Network segmentation: Divide the network into segments to prevent an attack from spreading to the entire network. This can limit the damage of a potential attack.
Monitoring and logging: Implement monitoring and logging to detect suspicious activity early and respond quickly. This helps identify and manage security incidents.

Should you pay the ransom in a ransomware attack?

When your data is encrypted and the attackers demand a ransom, it can be tempting to pay to quickly regain access to your data and minimize disruptions. But is this the best solution?

The National Security Authority (NSM) generally advises against paying ransoms in ransomware attacks. The reasoning behind this advice includes concerns about the spread of the malware and the fact that payment does not guarantee that you will regain control of your data.

Here are some arguments for why NSM does not recommend paying ransoms:

Cons:

No guarantee: There is no certainty that the data will be decrypted after payment. Many victims never regain access to their data, even after paying the ransom.
Supports crime: Payment funds criminal activities and provides attackers with resources to continue and intensify their attacks. This makes the problem worse for everyone.
Legal risks: Payment can be illegal if it goes to an organization sanctioned by authorities. This can lead to serious legal consequences for your business.
Increased risk: Paying organizations can be seen as easy targets and risk being attacked again in the future. Attackers may also leave backdoors in your system, making it easier to attack again later.
Wrong signal: Paying sends a message to attackers that their method is effective, which can encourage more attacks. This creates a vicious cycle where more attackers are motivated to carry out similar attacks.

What should I do instead?

Instead of paying the ransom, consider the following measures. Remember to take a moment to breathe and think clearly before acting:

Report the attack: Notify relevant authorities such as the National Security Authority (NSM) or the police.
Restore from backups: If you have regular backups, you can restore your data from these. Ensure the backups are isolated from the network to avoid them being encrypted as well.
Contact experts: Hire a cybersecurity firm like Sicra, which is skilled in handling ransomware attacks, to help you manage the situation and recover your data.
Use decryption tools: Sometimes there are decryption tools developed by security firms that can help you decrypt the data without paying the ransom. Experts can assist you with this.

Sicra and ransomware

Sicra can help you implement security solutions that reduce the risk of ransomware attacks and assist you if the worst happens. We also offer a CISO-for-hire service that can help you develop a robust security strategy for handling ransomware. This can be combined with security training for employees to prevent them from clicking on links containing ransomware.

Services:

Read about "CISO-for-hire" here >

Read about "security training" here >

Read about "incident response" here >

Need assistance?

We are happy to have a non-binding conversation.