Endpoint

4/21/2016
09:30 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

How Best To Back Up Your Data In Case Of A Ransomware Attack

A ransomware attack could be around the corner, but there are some practical steps you can take to back up your data and deflect the attack.

The recent surge in ransomware attacks against hospitals and other organizations has added a new sense of urgency to already-increasing security worries for small- to midsized businesses (SMBs) and consumers over how to protect their data from cyberattacks.

Ransomware is malicious code that uses advanced encryption algorithms to block system files and demand payment in return for the key that can decrypt the blocked content, explains Andra Zaharia, marcom manager at Heimdal Security.

“Similar to advanced financial- and data-stealing malware, ransomware can evade detection by normal antivirus products, but that’s where the similarity ends,” Zaharia says.

Ransomware attacks increased by 165% in 2015 compared to previous years, according to Engin Kirda, co-founder and chief architect at Lastline Labs. High-profile incidents include the Cryptolocker ransomware that infected 250,000 computers around the world, and this year, attacks suffered by Hollywood Presbyterian Medical Center in Los Angeles, MedStar Health Inc., Calif., Methodist Hospital in Henderson, Kentucky, and Southern California’s Chino Valley Medical Center and Desert Valley Hospital, both of which belong to the Prime Healthcare Service chain.

The malware encrypts the content and warns the victim that a ransom fee must be delivered within a certain timeframe. And if that ransom is not paid, the encrypted content is often lost for good.

The good news is that there are some common-sense steps you can take to protect your company – and your data -- from ransomware. A key step is properly backing up data regularly, as well as protecting your backup itself from getting infected with ransomware. Here’s a list of steps compiled with input from experts Zaharia, Kirda, Stu Sjouwerman, founder and CEO of KnowBe4, and Earl Carter, Talos senior threat researcher at Cisco Systems:

1.      There’s no protection from ransomware without backup. The first question a security pro will ask you when you report a ransomware attack is whether you have any backups. In many instances, simply by having a backup copy, you can then erase the drive, reinstall the operating system, restore the backup copy, and then start fresh. So remember:  no backup, no protection from ransomware.

2.      Think redundancy. Most experts say you need to have three forms of backup: realtime, daily incremental, and weekly incremental. One of the three should be offsite with a cloud provider and the other two can be at different spots at your company, or at two separate locations.

3.      Isolate your backups. The backups should not be connected to a shared drive. Sure, you can be infected with ransomware during a backup session, but you really hedge your bets when you isolate exposure to just when you run the backups. Also, ransomware can infect both mapped and unmapped drives, so your best bet is to separate your backup drives from the network.

4.      Take snapshots. By creating snapshots of the incremental updates, the attackers may still have access to recent updates, by they won’t have access to the previous incrementals.

5.      Automate patching. US-CERT reports that proactive patching can eliminate 85% of cyberattacks. This includes ransomware, so patch Windows or the core operating system as well as any third-party plug-ins you may use. Remember that the attackers start by looking at third-party apps and applications that are not used that frequently. In fact, if there are applications you don’t use that frequently, disable them and enable them only when you use them.

6.      Educate everyone. It’s important to make your staff aware of these threats. Start by doing a baseline, sending a simulation via email to see how many people clicked on the test email. Odds are the percentage of those who clicked will be high to start. Then train everyone with online simulation tools, making it engaging and getting everyone in the company involved. Finally, run random simulations that the staff knows is coming, but don’t reveal the timeframe. Over several months, the staff’s percentages will improve and you would have more than likely prevented a ransomware attack.

Related Content:

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11498
PUBLISHED: 2019-04-24
WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.
CVE-2019-11490
PUBLISHED: 2019-04-24
An issue was discovered in Npcap 0.992. Sending a malformed .pcap file with the loopback adapter using either pcap_sendqueue_queue() or pcap_sendqueue_transmit() results in kernel pool corruption. This could lead to arbitrary code executing inside the Windows kernel and allow escalation of privilege...
CVE-2019-11486
PUBLISHED: 2019-04-23
The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.
CVE-2019-11487
PUBLISHED: 2019-04-23
The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hu...
CVE-2018-7576
PUBLISHED: 2019-04-23
Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.