In last month’s blog I discussed your network potentially having numerous methods by which access could be achieved Is yours an open door network?

Sadly, it is often the case that when a security event occurs (notice I said “when”, not “if”) then the next step is how do you deal with that unsavoury event? This week’s blog is ‘Pay up or Else’ – with more of an emphasis on the ‘else’ part, you will hopefully be relieved to learn.

Ransomware – pay up or else? What would you do if you cannot access any of your business documents, all of your personal files, and you are being held from them by a countdown timer to their complete annihilation….

This method of money-making by the faceless and nameless ‘black-hatters’ of the internet is now becoming a serious threat. Recent research by Bitdefender reports that companies and individuals caught out in this way in the UK ‘are willing to pay the most to recover personal documents, photos and job-related documents’ with up to £400 being paid to decrypt locked and encrypted files for a start. Once you have shown that you are willing to pay, you are more aggressively targeted as your name joins a list of so-called “suckers” who will reach into their pockets for the convenience of getting their files back quickly.

It’s not just computers being hacked, SMishing is on the increase, SMishing is a similar attack whereby a user is sent an unsolicited SMS which tricks the user into downloading a rogue program or releasing sufficient personal details to compromise their security.

It is always best to minimise exposure to these scenarios where possible with common-sense, site or IP address blocking and end-point protection, but because it will happen, and when it does, what should you consider?

• Enforce a general information policy pertaining to what web-sites are SFW and NSFW and educate yourself and your team on the risks and the methods by which ransomware is activated.
• Ensure your electronic defence is as impenetrable as possible; antivirus, firewalls, IPS, web and mail
filtering, and enforce policies that prevent penetration through ensuring correct system configuration and device ‘hardening’.
• Implement a robust and incremental backup system of business/personal critical details, and keep offline backups offline.

  • Test backups regularly, and ensure everything that should be protected is.
  • Educate users to raise a flag of doubt at the earliest opportunity… not the last minute.
  • Educate, educate and educate again – your human firewall is the last line of defence!