Ransomware attacks have appeared frequently in the news lately – you may have heard about oil pipelines being shut down, meat processing plants being disrupted, or water treatment plants being hijacked. And if it seems like you are hearing about these sorts of attacks more often, it’s not just your imagination. Since 2019, there has been a 158% increase in ransomware attacks in North America, according to a study done by SonicWall.
Ransomware is a threat to every company out there – a threat that can have devastating consequences. Before we dive into ways you can protect yourself and your organization… what exactly is ransomware? We sat down with Demian Royer, the head of Voice Systems Engineering’s Infrastructure and Operations team, to help answer that.
So, what is ransomware? And how big of a threat is it to companies?
Ransomware is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access. In some instances, attackers may also steal an organization’s information for further leverage, by demanding payment in return for not disclosing the information to authorities, competitors, or the public.
Ransomware threats have escalated dramatically in the past two years and can pose an existential risk to organizations – many companies are devastated each year by the negative impact of these cyberattacks, and a portion of them never recover. The damages from these incidents can take the form of financial harm (ransom, forensic investigation, business interruption, asset restoration), brand damage (harm to company’s reputation, loss of business), and legal/regulatory risk.
What has contributed to the rise in ransomware attacks over the past two years?
One of the main ways that a person or a company gets infected with ransomware is through social engineering. Attackers send a phishing email in an attempt to get a user to click on a bad link or open an attachment that allows the ransomware in your environment. Their goal is to get you to impulsively click, and the best way to do that is to create a sense of urgency. So COVID became the perfect breeding ground for these attacks because, not only were people filled with worries and fears about the pandemic but they were also being bombarded with information from their local governments about status of vaccines and infection rates. Scammers had more material to work with.
What are other security threats are out there? Where does ransomware rank in that list?
While ransomware is the most prominent security threat to organizations right now, there are other types of threats such as Denial of Service (DDoS) attacks that can be significantly disruptive to business operations. The other most common type of threat is data breaches, where a cybercriminal steals valuable data from an organization, often without the organization being aware that the theft has taken place.
What can individual employees do to keep themselves and their organizations protected from cyber threats?
The most important things employees can do to help protect the organization are to follow all company security policies, report any unusual activity to IT, and to be constantly vigilant against social engineering attempts – especially phishing emails, which are responsible for a large portion of ransomware attacks.
There are also steps employees can take to protect themselves at home – these include always using up-to-date antivirus software, keeping their computers fully patched, being extra cautious about clicking links or attachments from untrusted sources, and regularly creating offline backups of their data (which helps protect against both ransomware and hard drive failures).
Why is security training important for companies?
A significant portion of cyber breaches stem from social engineering of unsuspecting employees, so effectively turning everyone in the organization into “human firewalls” can substantially reduce risk, both to the business and to employees in their personal lives. A well-educated user base is a highly effective tool to prevent cyber-attacks or to uncover them sooner. Constantly educating users through a variety of methods (training, posters, simulations, games, rewards, etc.) is a crucial component of effective cybersecurity.
The key is to repeat the training message at every opportunity – while you may sound like a broken record, the goal is to deeply ingrain cyber safety measures into employees’ way of thinking so that they can spot common threats. It’s really important to us that our users have a strong awareness of how to stay safe on the internet both at work and at home (especially since the two are so often the same since COVID). We can’t afford to have a cyber breach at work, and we don’t want any of our employees or their families getting scammed in their personal lives.
Is there any other advice you’d like to share?
Scammers will use any tactic that they think may elicit an impulsive or thoughtless reaction – they do this by preying on our emotions and creating a sense of urgency to act without thinking. The best thing you can do to avoid being scammed is to be cautious when receiving an unexpected email, text, or phone call and stop and think before clicking a link, opening an email attachment, or divulging personal information. Taking a few extra seconds to think before reacting can make all the difference in spotting and avoiding a threat.
