RANSOMWARE ATTACK: A NEW THREAT TO YOU AND YOUR BUSINESS IN 2021? WAYS TO RECOVER AND PREVENT RANSOMWARE.
Ransomware is a kind of malevolent software that is built for the purpose of blocking access to a computer system or the information stored in a computer. Cybercriminals use this software as a weapon to attack their prey selectively or at random and ask for ransom (mostly not in usual bank transactions but in cryptocurrency) in return for access to the data or system that was hijacked.
Generally, ransomware is used to encrypt the data stored in a system by the attacker. The encrypted data then can only be accessed through the decryption key that can be obtained by paying the attacker. Detailed instruction of how to proceed to obtain the decryption key is provided to the victim, how the payment can be made, and then how they will be able to regain their access to their lost data.
How to prevent it:
Never click on the links that are from untrusted contacts or websites. Additionally, avoid downloading contents that you suspect are from unverified contacts or platforms.
If you receive emails from an unknown contact, it is always suggested not to open the attached files on your device firsthand. Always confirm the senders’ authenticity. If you suspect that the contents of the email are not usual then don’t hesitate to give a call to the sender to become sure of the contents’ authenticity.
Only download from trusted sites.
Abstain from giving away personal information like email, phone number, address, social security number, credit card number, etc.
Try using content scanning and filtering services provided by your mail server.
Never use unfamiliar or untrusted USB drives
Make sure that your operating system and software are always up to date.
Try avoiding public WIFI. In case it is an emergency then make sure to use a trusted VPN to access the internet.
The most important thing is to keep a backup of your data. Try the backup system to upgrade automatically so that even if you forget to do so, in the event of an attack you can still restore your backup data.
What if you get attacked?
Incident Response: Initiate the incident response team if you have one or consult professionals to do so. Here the incident response team will do forensics to understand how much you are exposed and vulnerable. They will then help you to discover and understand the availability of backups and the possibilities of recovery process and time. All this would help you to assess the real scenario of the attack and where do you stand at this point.
Investigating the damage and possibility of recovering: Now you need to assess the missing data and the system that is affected so that you can determine what it would take to get back in business in this situation.
Threat intelligence: Cyber intelligence performs a critical role in the event of a ransomware attack. It would help you to understand the threat actor or threat actor group, their motivation, methods, previous activity, typical payouts, etc. These would eventually help you to understand the attacker/s and would be very useful while negotiating with them.
Consulting negotiator: At this point, you should consult a negotiator if you have not done it yet. Then you should keep all the key stakeholders like an insurer, outside channel, PR specialist, etc. in the loop to proceed further. Now the professional third parties or the negotiator will start the communication with the attacker.
The negotiator will start the communication after keeping all the stakeholders informed about the scenario
Here the negotiator will structure a feasible deal with the attacker if possible
Then you need to decide whether you are willing to pay or not. Before doing so, of course, the reports that you have gathered would help you to determine how crucial the data is and whether paying the attacker is worth it or not.
How to transfer the money, what are the payment methods, etc
Handling cryptocurrency transactions
How the data will be recovered
What to do after payment if the data or encryption key is not delivered by the attacker.