As ransomware continues to evolve, it’s becoming one of the most dangerous threats of all time.
More dangerous than a bank heist. Definitely much more threatening than identity theft. Criminals have increased financial motivations to break into your network, deploy and hold your organization’s data hostage.
For a criminal, it’s only time.
They have as many tries as they want to take. No risk of getting shot or caught. And they have everything to win and really not much to lose when it comes to getting someone to pay to decrypt their data—or at very least to extort them into paying for some of their most sensitive of information.
Unlike other malware, ransomware steals from you—it now directly targets you as its victim, holds your files ransom and even publishes those files for all to see (or threatens at very least) if you don’t pay. For you, the clock is ticking. For criminals, they have nothing to lose. But if you refuse to pay, might have a LOT to lose.
Imagine your network was ransomed and a hacker was threatening to release your sensitive data—maybe patient names, maybe client information, or even HR records—on the Dark Web. Let’s say it made your stomach turn to even consider paying the ransom.
What would happen if the criminals did what they said they were going to do?
That information would probably be posted for all to see—maybe even on a website exposing your brand and state of security for hackers and non-hackers alike. That criminal might hijack someone else’s website just to post your personal information (he or she might also post it on the Dark Web as well).
What would you do after this information went viral?
Maybe tell your story about what not to do in a ransom situation? Would you have second thoughts next time about paying the ransom?
I don’t want you to even get into a scenario where you have to make choices like this. Today, remediating your network from an attack is essentially putting you between a rock and a hard place.
The rock: you pay someone that you know is a criminal and you knowingly are handing over money to fuel more attacks on people just like you. You likely become a target for future attacks because hackers know you are willing to pay for your data (you’re a quicker transaction than someone who decides not to pay). On top of all that, do you really know that when you make a payment to a known criminal, will they follow through with their promise? Or will their decryption process recover everything the way it was before?
The hard place: you decide not to pay the ransom. The criminals extort you for additional money—they have all of your data and are eager to release it if you don’t pay on time. When your payment timeline expires, they post your name and your organization online, pronouncing you a victim (which may have PR implications for you). They release your entire patient, client, HR—you name it—data set for all to see. You also have the major hurdle of an actual recovery—which can take weeks to months of downtime (no income coming in). This has caused several businesses to close recently.
What’s scarier about 2020?
Today, ransomware software is more advanced and stealthy than it was even 3 months ago. Ransomware developers are making their software easier to use, trickier to detect and more penetrating. Some ransomware variants even remove your data recovery options as they encrypt your entire network, making it even more impossible to restore.
How to stay safe?
I want to be entirely honest with you. You will never be 100% from everything. If you wanted to secure your house and bought to top of the line alarm system, new locks on your doors and windows, do you think you’re completely immune to a break in?
You’re making sure you’re not the easiest target on your street, but everything you put in place couldn’t stop a thief from throwing a rock through your window and getting in. It just makes it a lot harder than turning the doorknob.
Same thing goes for network security. The harder your network is to break in, the better someone else’s less secure network looks. If you’re not the low hanging fruit, you are probably not a good target for most criminals.
Best way to prevent being that easy target?
Cybersecurity experts recommend a network security assessment to evaluate your current weaknesses and prioritize how you’re going to address them.