Best practices to reduce the risk of ransomware

The increase in attacks and the focus on users as gateways requires companies to be prepared and prepared to respond.

Recent years have been characterized by a growth in the number, intensity and impact of ransomware, which is why it has become one of the main elements to consider when establishing data security solutions in companies.

The 8 Most Common IT Outsourcing Problems for Resales

Finding ways to defend against and reduce the risk of attacks depends, first and foremost, on understanding how they occur and how hackers access data in your enterprise environment.

There are two main vectors for attacks in commercial IT environments. The first is remote control over user computers, which allows the invader to travel across the network to the site where database administrator credentials can be found, granting access to all company information. Remote control is possible through the employee himself, who is seduced by a phishing message with attachments or links to web pages containing the malicious code which, once logged in, is loaded onto the computer terminal.

From the moment the device becomes vulnerable, inserted threats begin to scan the environment looking for a device that allows access to the data network. This way, from the moment it is consolidated on an administrator’s machine, hackers can remotely encrypt or wipe the data and demand a ransom.

The second method used is more of a direct attack, a frontal theft of the database servers. Most companies have websites and applications intended for public access. Hackers search these channels for the one with the most vulnerable server, exploring areas that allow the threat to take root in the data center. We therefore see that the main base of the attack is the user who has less experience and knowledge to identify the dangers of such an attack.

NVIDIA bets on IT innovation with NetApp

Such an attack is only effective in cases where the IT team has not established the correct separation between public web pages and database and file sharing servers, a common mistake in small teams. In these cases, the threat uses this access to perform a database search and hijack essential business information.

Although the second vector requires more sophistication, this is the main form of action for ransomware threats, testing the specialization and professionalization of hackers, requiring greater attention to the security of corporate information.

How to reduce the risk of ransomware?

One of the first actions to reduce the risk of invasion is to orient all users who have access to the company network on the most common types of bait, keeping them informed on the news that emerges over the course of the day. Furthermore, a powerful and up-to-date antivirus is essential to block the most known attacks and help your computer by warning you of messages that could be harmful.

Another important step is to have an incident response plan, planning all the actions that need to be taken in the event of an attack, answering questions such as “What are the first steps?”, “Who are the people who need to be notified?”, “What are the most urgent decisions to make?”, among others. The entire process must be recorded in manuals to assist the security team in defense agility and block the path of the virus as early as possible.

Separating and isolating your database is a great option to deter hackers by creating layers of security such as encrypted password folders. Another important point is to have a backup with this updated information. This way, even if your data is hijacked, you can save time by evaluating whether it is worth paying the ransom or not.

If the database is very important for the continuity of a business and needs additional protection, hosting this information in the Cloud or in digitized environments, with limited access by authorized persons, should be considered. These services offer encryption and special levels of protection at an affordable cost.

To conclude, the question that cannot remain unanswered: Pay the ransom or not? The opinion of the majority of experts is not to pay it, precisely to reduce the importance of this type of crime. But the decision is easy when it comes to people who are not involved in the company.

Sources:

http://www.darkreading.com/attacks-breaches/best-practices-for-lowering-ransomware-risk/a/d-id/1328294

http://www.darkreading.com/attacks-breaches/best-practices-for-lowering-ransomware-risk/a/d-id/1328294