One morning employees arrive at the office, turn on their computers, and instead of the desktop a message appears: all your files have been encrypted. To get them back, pay a sum in bitcoin by a certain date. That is a ransomware attack, one of the most common and damaging threats in cybersecurity, hitting giant companies as well as clinics, accounting offices and small businesses.
How does it work? Attackers first need to get in. Common routes are a phishing email with a malicious file or link, a leaked password for a remote-access service, or a flaw in software that was not updated, such as a network drive, router or server. Once inside, attackers do not always strike immediately. Sometimes they move around the network for days or weeks, find the backups and disable them, and only then encrypt every machine at once.
In recent years attackers added another stage called 'double extortion': before encrypting, they steal a copy of the data and threaten to publish it if the ransom is not paid. So even a business with good backups is under pressure, because its customers' data may leak. Recently, for example, network drive maker Synology warned customers of a wave of ransomware attacks on devices that had not been updated.
Should you pay? Law enforcement and security firms advise against it. There is no guarantee attackers will actually release the files or delete the stolen data, payment funds the next attack, and it can mark the business as a target that pays. In some cases paying certain actors may also be legally problematic. Either way the decision should be made with professionals, not under the pressure of the moment.
What to do in advance? Five steps cover most of the risk. One: backups kept separately and not always connected to the network, and tested to make sure you can actually restore. Two: automatic updates everywhere, including routers and drives. Three: two-step verification for all remote access and email. Four: a short staff training on spotting phishing. Five: a ready plan for who to call and what to do if it happens. And if it does, contact professionals and the National Cyber Directorate immediately.
