Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/21/2016
09:30 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

How Best To Back Up Your Data In Case Of A Ransomware Attack

A ransomware attack could be around the corner, but there are some practical steps you can take to back up your data and deflect the attack.

The recent surge in ransomware attacks against hospitals and other organizations has added a new sense of urgency to already-increasing security worries for small- to midsized businesses (SMBs) and consumers over how to protect their data from cyberattacks.

Ransomware is malicious code that uses advanced encryption algorithms to block system files and demand payment in return for the key that can decrypt the blocked content, explains Andra Zaharia, marcom manager at Heimdal Security.

“Similar to advanced financial- and data-stealing malware, ransomware can evade detection by normal antivirus products, but that’s where the similarity ends,” Zaharia says.

Ransomware attacks increased by 165% in 2015 compared to previous years, according to Engin Kirda, co-founder and chief architect at Lastline Labs. High-profile incidents include the Cryptolocker ransomware that infected 250,000 computers around the world, and this year, attacks suffered by Hollywood Presbyterian Medical Center in Los Angeles, MedStar Health Inc., Calif., Methodist Hospital in Henderson, Kentucky, and Southern California’s Chino Valley Medical Center and Desert Valley Hospital, both of which belong to the Prime Healthcare Service chain.

The malware encrypts the content and warns the victim that a ransom fee must be delivered within a certain timeframe. And if that ransom is not paid, the encrypted content is often lost for good.

The good news is that there are some common-sense steps you can take to protect your company – and your data -- from ransomware. A key step is properly backing up data regularly, as well as protecting your backup itself from getting infected with ransomware. Here’s a list of steps compiled with input from experts Zaharia, Kirda, Stu Sjouwerman, founder and CEO of KnowBe4, and Earl Carter, Talos senior threat researcher at Cisco Systems:

1.      There’s no protection from ransomware without backup. The first question a security pro will ask you when you report a ransomware attack is whether you have any backups. In many instances, simply by having a backup copy, you can then erase the drive, reinstall the operating system, restore the backup copy, and then start fresh. So remember:  no backup, no protection from ransomware.

2.      Think redundancy. Most experts say you need to have three forms of backup: realtime, daily incremental, and weekly incremental. One of the three should be offsite with a cloud provider and the other two can be at different spots at your company, or at two separate locations.

3.      Isolate your backups. The backups should not be connected to a shared drive. Sure, you can be infected with ransomware during a backup session, but you really hedge your bets when you isolate exposure to just when you run the backups. Also, ransomware can infect both mapped and unmapped drives, so your best bet is to separate your backup drives from the network.

4.      Take snapshots. By creating snapshots of the incremental updates, the attackers may still have access to recent updates, by they won’t have access to the previous incrementals.

5.      Automate patching. US-CERT reports that proactive patching can eliminate 85% of cyberattacks. This includes ransomware, so patch Windows or the core operating system as well as any third-party plug-ins you may use. Remember that the attackers start by looking at third-party apps and applications that are not used that frequently. In fact, if there are applications you don’t use that frequently, disable them and enable them only when you use them.

6.      Educate everyone. It’s important to make your staff aware of these threats. Start by doing a baseline, sending a simulation via email to see how many people clicked on the test email. Odds are the percentage of those who clicked will be high to start. Then train everyone with online simulation tools, making it engaging and getting everyone in the company involved. Finally, run random simulations that the staff knows is coming, but don’t reveal the timeframe. Over several months, the staff’s percentages will improve and you would have more than likely prevented a ransomware attack.

Related Content:

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21392
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addre...
CVE-2021-21393
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-29429
PUBLISHED: 2021-04-12
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded in...
CVE-2021-21394
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-22497
PUBLISHED: 2021-04-12
Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.