A malware attack can seriously derail your business and its operations, so we’ve put together some advice and guidance on ransomware and malware attacks, and how to protect your business against them.
Remember, the best defence is good planning. The first step to protecting your business against a ransomware or malware attack is a good disaster recovery and business continuity plan. This takes into consideration all elements of your business, how you operate, store and use data, and communicate, and should help you avoid an attack and minimise the damage in case one does take place.
In this article, we’ll explain what ransomware and malware are, and some steps you can take to avoid a cyberattack.
What is malware?
Malware is any type of malicious software, which when installed on a device carries out any number of harmful actions, including:
• Accessing, deleting, or encrypting your data
• Locking or corrupting your device
• Using your device to mine cryptocurrency
• Obtaining security credentials such as passwords and usernames, which can be used to access your systems
• Taking control of your device and using it to attack other organisations or individuals
What is ransomware?
Ransomware falls under the category of malware: more specifically, it’s a type of malware that will take control of your device, preventing you from being able to use it. The attacker will ask for payment in return for giving back control of your device or access to your data. Often, even if you pay the ransom, there’s no guarantee that you’ll get access to your device or data again, or that your data won’t be stolen. For this reason, paying the ransomware is generally discouraged; it can also make you more likely to be targeted in the future.
How do I protect against a malware or ransomware attack?
1. Ensure all your data is properly backed up
Backing up your data securely is essential when it comes to protecting against a ransomware attack. Often, the easiest and most cost-effective way to back up your data is via the cloud: it’s easy to save regular backups to the cloud and helps you avoid costly and bulky data storage solutions.
Ransomware attacks can infiltrate your cloud backups, so additional offsite and off-line backups are a good idea. This involves storing copies of your data in a different physical location, so a cyberattacker can’t access it.
2. Prevent malware from being delivered and run in the first place
Your organisation should have rigorous defences to prevent malware taking hold of your devices in the first place – this is the best way to prevent against the undesirable consequences. These precautions are usually done at the network level rather than by users, but training and educating your team is also very important – after all, an organisation is only as strong as its weakest link, and human error accounts for a large percentage of malware infiltration.
Your IT department or outsourced IT provider should implement precautions such as:
- Mail filtering, which can block suspicious emails and remove harmful attachments
- A VPN for remotely accessing services (for example when working from home or remotely)
- Enable 2FA or MFA (two-factor/multi-factor authentication) for all network access points
3. Implement antivirus software and ensure security patches are up to date
Good antivirus software will provide a strong first line of defence against a cyberattack. There are lots of options out there, so take some time (or ask an expert) to choose a solution that’s right for your business and budget. Depending on how critical it is to your business, consider more advanced security systems such as proactive monitoring, where your network will be monitored 24/7 so that an attack can be stopped as soon as possible.
4. Regularly train your employees
Don’t make this a box-checking exercise: ensure that all new employees are fully trained in your procedures for avoiding a malware attack, and regularly update the training of existing employees too. User error or lack of training can easily compromise your precautions if a cyber threat makes it through your first lines of defence, so train employees on good email, device and browsing security.
5. Plan for the attack
While the best-case scenario is that your defences will prevent an attack from taking place, it’s important to plan for the worst case too. Take time to consider your legal obligations in the event of an attack, plan a communications strategy to alert internal and external stakeholders of the breach, and plan how you’ll respond to the demand for ransom, or the threat of your data being shared. Planning for these eventualities ahead of time will help you make the right decisions if the worst happens.
If all this feels overwhelming, getting advice and support from the experts is a good idea: we provide IT security advice for organisations of all sizes, and we can help you find solutions that are right for your business. Get in touch to find out more.
