Cyber security threats are cyclic – data breaches, phishing attacks, and denial of service attacks come into the spotlight on a regular basis. This week, we have been revisited by ransomware. Ransomware is a type of malware attack that encrypts files on a victim computer, making them completely inaccessible. This can be undone be paying a fee, usually through a cryptocurrency such as bitcoin.
There are three primary ways to protect a company from a ransomware attack. The first is the easiest: regular updates of software. Technology companies, particularly those that support enterprises, are quick to release patches to plug security holes. You need to be just as quick to propagate those changes to every machine on your network. This can be done easily through proper configuration and group policies. If you have that one special machine that can’t be upgraded for whatever reason, take steps to isolate it from the internet, only use it for that single purpose, and find a way to virtualize or replace it.
The second way is through an automated system of regular backups. For personal files, I use portable hard drives for storage in the house, and Amazon Web Services’ Glacier in case the house burns down. While I’m only storing ~50 Gb of family photos, the peace of mind isn’t that expensive: about $5 total to upload, and $0.50 per month to maintain. I have heard that the retrieval costs can be comparatively high, but it will be worth it to not lose those memories.
The hardest form of cyber security protection is always user education. Some can get through their 9-5 being a computer security expert. Everyone else needs to do that, plus accounting, product management, or sales. But we can nudge people in the right direction. Provide relevant, engaging education beyond the rote slide decks or online trainings. Label emails that are coming from external sources as such. Finally, test your users through social penetration testing. The best lessons are learned through failure, and if we can teach that lesson without catastrophic risk, all the better.
For more information on the most recent ransomware attack, check out Brian Kreb’s article on it. For an interesting take on establishing trust between ransomware victims and their digital captors, Matt Levine writes on blockchain-enabled smart contracts.
Jim Solce 