Ransomware attacks are increasingly popular precisely because they are so lucrative. Implementing a comprehensive ransomware prevention and recovery strategy that includes the steps outlined in this article can make it harder for criminals to hijack your data — and easier to get back on track if a breach occurs.
What is a ransomware attack?
Ransomware is a form of malware. During a ransomware attack, a cybercriminal hacks into your network or computer and determines which data or system holds the most value to you. This information can be seized by irrevocably encrypting it, making it unusable. The cybercriminal may then demand a ransom in exchange for providing a key to decrypt your data.
Some attacks may go a step forward, using what’s called double extortion. In this scenario, the hacker will not only hold a victim’s data for ransom, but also threaten to publish the stolen data on the dark web or release the data publicly. Victims often pay the ransom to get back up and running quickly or avoid embarrassment and reputational damage.
Ransomware attacks are also increasingly easy to execute. This lower barrier to entry is due to the rise of Ransomware as a Service (RaaS). Now, run-of-the-mill cybercriminals can purchase or rent a ransomware subscription offered by a RaaS operator, granting them access to a sophisticated, pre-developed set of ransomware tools.
How do hackers target victims?
Individuals, small and medium-sized businesses and family offices are all attractive ransomware targets given the perception that they may have weaker defenses in place.
Hackers use a variety of techniques to sneak in and infect systems. The primary gateways include:
Email phishing: With this technique, a cybercriminal sends an email that seems authentic and looks like it’s from a trusted contact or source. The email typically asks the recipient to click on a link or download an attachment that contains the ransomware.
Remote desktop connections: Cybercriminals like to target systems that grant remote access to computers and databases. They typically do so by obtaining user credentials through trial-end-error methods or purchasing them on the dark web. Once fraudsters obtain access, they can easily install ransomware on your system.
Software vulnerabilities: Cybercriminals are experts at detecting security vulnerabilities in popular software programs and exploiting them to gain control of your system and initiate an attack.
Online content: Simply clicking a digital ad or visiting a website that’s embedded with malware can infect your system.
Defending your data
The best way to handle a ransomware attack is to never have one. Taking the appropriate prevention steps greatly reduces the risk of enduring the financial distress and organizational turmoil created by these attacks.
- Regularly back up your data: Backups may be the best way to restore your data, but be sure to periodically test your backups to ensure everything is working as expected.
- Employ a 3, 2, 1 strategy: Have three different copies of your data, use two different mediums for your backups (like a hard drive and a USB drive) and store at least one copy of your data offsite (such as on a cloud backup provider).
- Promptly apply security patches: These include security updates for your operating system, software and hardware. It’s best to enable automatic updates as soon as they are available.
- Harden access to your most sensitive data and systems: Require Muli-Factor Authentication (MFA) wherever possible and institute the principle of least privilege, only granting users access to data and systems that they absolutely need.
- Follow remote access best practices: This includes auditing your network for systems using remote access software, locking down unnecessary remote access entry points, applying MFA and tracking remote login attempts.
- Be mindful of phishing emails, phone calls and text messages: Never click on a link or open an attachment from unsolicited sources. If you are unsure if message you receive is legitimate, call the individual or organization who the sender claims to be using a known, trusted phone number.
- Conduct training sessions: As a business or family office, your employees may be the weakest link in your security system. Educate them throughout the year about ransomware and develop ongoing awareness exercises, such as email phishing simulations.
- Develop a disaster response plan: A ransomware attack can create chaos within an organization. That’s why it’s essential to be proactive and have an incident response plan in place that includes your response and notification procedures. Consider including the name of a reputable IT support service or data recovery specialist as part of your plan.
Responding to an attack
Ransomware attacks lead to difficult choices. If you, your family or your business are the victim of a ransomware attack, consult a security specialist, law enforcement and alert your Morgan Stanley Financial Advisor.
You should also report the crime to the Internet Crime Complaint Center (IC3), CISA or a Secret Service Field Office. Reporting incidents can provide investigators with the information needed to track and punish cybercriminals and deter future attacks.
Other steps to consider taking after an attack include:
- Identifying and removing any infected computers immediately from your network
- Turning off any affected computers that haven’t been completely corrupted to contain the damage
- Changing all account and network passwords
For additional security best practices, see the FBI’s ransomware overview.
