Endpoint

4/21/2016
09:30 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

How Best To Back Up Your Data In Case Of A Ransomware Attack

A ransomware attack could be around the corner, but there are some practical steps you can take to back up your data and deflect the attack.

The recent surge in ransomware attacks against hospitals and other organizations has added a new sense of urgency to already-increasing security worries for small- to midsized businesses (SMBs) and consumers over how to protect their data from cyberattacks.

Ransomware is malicious code that uses advanced encryption algorithms to block system files and demand payment in return for the key that can decrypt the blocked content, explains Andra Zaharia, marcom manager at Heimdal Security.

“Similar to advanced financial- and data-stealing malware, ransomware can evade detection by normal antivirus products, but that’s where the similarity ends,” Zaharia says.

Ransomware attacks increased by 165% in 2015 compared to previous years, according to Engin Kirda, co-founder and chief architect at Lastline Labs. High-profile incidents include the Cryptolocker ransomware that infected 250,000 computers around the world, and this year, attacks suffered by Hollywood Presbyterian Medical Center in Los Angeles, MedStar Health Inc., Calif., Methodist Hospital in Henderson, Kentucky, and Southern California’s Chino Valley Medical Center and Desert Valley Hospital, both of which belong to the Prime Healthcare Service chain.

The malware encrypts the content and warns the victim that a ransom fee must be delivered within a certain timeframe. And if that ransom is not paid, the encrypted content is often lost for good.

The good news is that there are some common-sense steps you can take to protect your company – and your data -- from ransomware. A key step is properly backing up data regularly, as well as protecting your backup itself from getting infected with ransomware. Here’s a list of steps compiled with input from experts Zaharia, Kirda, Stu Sjouwerman, founder and CEO of KnowBe4, and Earl Carter, Talos senior threat researcher at Cisco Systems:

1.      There’s no protection from ransomware without backup. The first question a security pro will ask you when you report a ransomware attack is whether you have any backups. In many instances, simply by having a backup copy, you can then erase the drive, reinstall the operating system, restore the backup copy, and then start fresh. So remember:  no backup, no protection from ransomware.

2.      Think redundancy. Most experts say you need to have three forms of backup: realtime, daily incremental, and weekly incremental. One of the three should be offsite with a cloud provider and the other two can be at different spots at your company, or at two separate locations.

3.      Isolate your backups. The backups should not be connected to a shared drive. Sure, you can be infected with ransomware during a backup session, but you really hedge your bets when you isolate exposure to just when you run the backups. Also, ransomware can infect both mapped and unmapped drives, so your best bet is to separate your backup drives from the network.

4.      Take snapshots. By creating snapshots of the incremental updates, the attackers may still have access to recent updates, by they won’t have access to the previous incrementals.

5.      Automate patching. US-CERT reports that proactive patching can eliminate 85% of cyberattacks. This includes ransomware, so patch Windows or the core operating system as well as any third-party plug-ins you may use. Remember that the attackers start by looking at third-party apps and applications that are not used that frequently. In fact, if there are applications you don’t use that frequently, disable them and enable them only when you use them.

6.      Educate everyone. It’s important to make your staff aware of these threats. Start by doing a baseline, sending a simulation via email to see how many people clicked on the test email. Odds are the percentage of those who clicked will be high to start. Then train everyone with online simulation tools, making it engaging and getting everyone in the company involved. Finally, run random simulations that the staff knows is coming, but don’t reveal the timeframe. Over several months, the staff’s percentages will improve and you would have more than likely prevented a ransomware attack.

Related Content:

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.