Solid Guardian: How Proactive IT Monitoring Keeps Your Business Running
The platform behind our Managed IT Services: faster support, real-time visibility, patching and proactive maintenance.
Read the guide →Ransomware prevention in short
Ransomware is malware that locks your data until a ransom is paid, and it most often arrives through phishing emails. To prevent it: do not click unverified links or attachments, scan and monitor email, avoid giving out personal information, use firewalls and endpoint security, back up your data, avoid public Wi-Fi or use a VPN, use multi-factor authentication, monitor network activity, keep software updated and educate your employees. Backups reduce the pressure to pay if an attack does get through.
What happened to one of our clients
A law firm in Sandton learned this the hard way. An employee let their child use a work computer to play a game. The game’s download carried ransomware, and within hours it had encrypted the firm’s entire SharePoint: every client file the practice relied on.
We restored everything within hours. Nothing about the attack was sophisticated. One shared device and one download were all it took.
Ransom used to be such a farfetched concept when it came to businesses. The word brought to mind kidnappings and hostage situations, all unrelated to the day-to-day operations of companies. But as businesses have moved into the digital space, they have had to change their perception of what can be held ransom, as criminals target data over people, and organisations over individuals, in what has become known as ransomware attacks.
Knowing how to prevent ransomware from infiltrating your company and following ransomware prevention best practices can see your business saving not only significant amounts of money, but your reputation as well.
What Is Ransomware?
Before we can look at how to prevent ransomware attacks, it’s important to understand what ransomware is, and how it can infiltrate your business.
Ransomware is a form of malware, or malicious app, that provides cybercriminals with access to your data. The most common way of getting ransomware onto a company’s network is through phishing emails. These mails contain links and attachments which, when clicked, install ransomware apps onto individual devices. Through these devices, attackers are then able to gain access to networks and lock the information contained on them, preventing businesses from accessing their data unless they pay a ransom demand for its release.
Understanding ransomware is a good first step, but you also need to look at how to prevent ransomware from impacting your business operations.
How To Prevent Ransomware
Protecting your business and your data has never been more important. Falling victim to a ransomware attack can not only cost you money in retrieving your data, but can lead to significant downtime, incur penalties if personal data became compromised, and can see your hard-earned reputation being permanently damaged. After all, if your clients can’t trust you to keep their data secure, can they trust your services?
Thankfully, there are best practices that businesses can take and plenty of advice on how to avoid ransomware attacks, and to limit an attack’s impact if your business does fall victim to one. Let’s look at how to prevent ransomware in 10 steps:
- Don’t Click on Unverified Links and Attachments
Many people automatically open links and attachments in the emails they receive without really thinking about them, since it is part of their daily routine.One of the ways that ransomware gets installed on devices is through malicious links and attachments in phishing emails. By taking the time to check links and who they have been sent from, rather than opening them automatically, you can increase your company’s overall security, and lessen the likelihood of malware being installed on your devices. - Scan & Monitor Emails
Educating your employees about the risks that phishing emails can pose is a great way of reducing the likelihood of ransomware infiltrations, but it’s not the only measure that you take. Using a solution like Microsoft Advanced Threat Protection will provide holistic security across your business, and one of the areas that it focusses on is email security. It scans and monitors emails, automatically detecting when a link or attachments seems suspicious and providing a warning to users before they click or open them, and offering your business an extra layer of protection against ransomware attacks. - Avoid Giving Out Personal Information
It’s not just emails that get received that your company needs to be concerned with, but what is sent as well. While phishing emails will often install malware and ransomware straight away, the intention behind them is also to gain access to personal information and user credentials. A malicious link might not immediately install an application, for example, but might pose as a trusted source like a banking institution, and ask a user to login. This information is then sent directly to the attacker, providing them with the opportunity to use those credentials to their advantage at a later stage. - Use Firewalls & Endpoint Security
General cyber security measures that your business might already have in place can stop ransomware attacks in their tracks. For example, ensuring that your employees devices, or endpoints, are secured against viruses and malware can put a stop to ransomware before it has the chance to reach your network. Plus, putting strong firewall rules in place can prevent unauthorised access, preventing attackers from infiltrating your systems. - Always Backup Your Data
One of the main reasons that ransomware attacks are so effective is that businesses are prepared to pay exorbitant amounts to regain access to their data. If you have a cloud backup of your data at hand, the threat of a ransomware attack, and the need to give in to the attacker’s demands, will be greatly reduced. This is why regularly backing up your data to the cloud, and having a disaster recovery plan to ensure that your operations continue uninterrupted, is essential in this digital age. - Avoid Using Public Wi-Fi
While the public Wi-Fi that you find at airports and restaurants is handy for keeping your devices connected, it also poses a risk to your data security. These public networks are often unsecured, making it easy for attackers to use them and gain access to user credentials, and in turn company networks. If you find yourself needing to use public hotspots, we highly recommend using a Virtual Private Network, or VPN, to make your data more difficult to intercept. - Strong, Secure User Authentication
While ransomware can help attackers gain access to user credentials, strong Identity and Access Management can stop them from infiltrating your network. Ensuring that your employees use Multi-Factor Authentication, for example, will mean that while an attacker may have a user’s login details, without access to a separate device, or to the person themselves in the case of biometric authenticators, their access will be denied straight away. - Keep a Close Eye on Your Network
Another area where Identity and Access Management can protect your business against ransomware attacks is through close monitoring and reporting on user activity. When you use Microsoft 365 solutions like SharePoint, OneDrive and Azure, Microsoft automatically logs user activity, finding a baseline for what is expected and what is unusual. It then alerts you to unusual activity on your network as soon as it occurs, providing you with the opportunity to take pro-active steps that stop intruders from gaining any further access. - Keep Your Software & Apps Updated
Another way that attackers gain access to your networks in order to install ransomware is through vulnerabilities in your business software and apps. This is why it’s essential for any business to keep their solutions up-to-date, as providers will release patches to fix vulnerabilities as soon as they are identified. Using outdated software is an unnecessary risk that no company can afford to take. - Educate Your Employees
Prevention is better than cure, as the saying goes. Making sure that your teams know about the threat of ransomware, and how they can avoid it, will secure your business’ data even further. Solutions like Microsoft Defender for Office 365 can help you in this endeavour, letting you send pre-emptive ‘phishing’ mails to your employees, measuring how they respond, and training them in areas that their own personal security can be improved.
Now that we’ve looked at how to prevent ransomware from infecting your business networks, you may feel slightly overwhelmed at all the steps that you need to take. But rest assured that you don’t need to take these steps alone. As an IT company with vast experience in keeping business data secure, Solid Systems is perfectly equipped to advise you on, and help you implement, best practices and security measures that will keep your company information safe. Get in touch with us today, and step into the future confidently.
How a Ransomware Attack Unfolds
Most attacks follow the same four stages. Knowing them shows where each of the tips above stops one.
- Getting in. Through a phishing email, a stolen password or an unpatched system.
- Spreading. The attacker gains more access and moves across the network, looking for important files and for the backups.
- Encrypting. Files are locked, and a ransom note demands payment, usually in cryptocurrency.
- Threatening to leak. Many attackers copy the data first and threaten to publish it, which adds the risk of fines under POPIA to the damage to client trust.
How Microsoft 365 Helps Stop Ransomware
If your business runs on Microsoft 365, several protections are built in or available on business plans:
- Microsoft Defender for Endpoint detects and blocks ransomware on laptops and desktops as it happens.
- OneDrive and SharePoint version history keeps earlier copies of files, and a whole OneDrive can be restored to a point before an attack.
- Multi-factor authentication stops attackers signing in with a stolen password.
- Microsoft Secure Score lists the settings that leave you exposed, so they can be fixed before an attack.
Frequently Asked Questions (FAQs)
More questions
How does ransomware get into a business?
The most common way is through phishing emails. Clicking a link or attachment installs ransomware on a device, and attackers then use that device to reach the network and lock the data on it.
Why does backing up data protect against ransomware?
Ransomware works because businesses will pay to get their data back. With a cloud backup and a disaster recovery plan, you can restore your data and keep operating, so the threat is greatly reduced.
Can Microsoft 365 help protect against ransomware?
Yes. Microsoft Advanced Threat Protection scans emails and warns users about suspicious links and attachments, and Microsoft Defender for Office 365 lets you send test phishing mails to train employees.