How Best To Back Up Your Data In Case Of A Ransomware Attack

The recent surge in ransomware attacks against hospitals and other organizations has added a new sense of urgency to already-increasing security worries for small- to midsized businesses (SMBs) and consumers over how to protect their data from cyberattacks.

Ransomware is malicious code that uses advanced encryption algorithms to block system files and demand payment in return for the key that can decrypt the blocked content, explains Andra Zaharia, marcom manager at Heimdal Security.

“Similar to advanced financial- and data-stealing malware, ransomware can evade detection by normal antivirus products, but that’s where the similarity ends,” Zaharia says.

Ransomware attacks increased by 165% in 2015 compared to previous years, according to Engin Kirda, co-founder and chief architect at Lastline Labs. High-profile incidents include the Cryptolocker ransomware that infected 250,000 computers around the world, and this year, attacks suffered by Hollywood Presbyterian Medical Center in Los Angeles, MedStar Health Inc., Calif., Methodist Hospital in Henderson, Kentucky, and Southern California’s Chino Valley Medical Center and Desert Valley Hospital, both of which belong to the Prime Healthcare Service chain.

The malware encrypts the content and warns the victim that a ransom fee must be delivered within a certain timeframe. And if that ransom is not paid, the encrypted content is often lost for good.

The good news is that there are some common-sense steps you can take to protect your company – and your data -- from ransomware. A key step is properly backing up data regularly, as well as protecting your backup itself from getting infected with ransomware. Here’s a list of steps compiled with input from experts Zaharia, Kirda, Stu Sjouwerman, founder and CEO of KnowBe4, and Earl Carter, Talos senior threat researcher at Cisco Systems:

1.      There’s no protection from ransomware without backup. The first question a security pro will ask you when you report a ransomware attack is whether you have any backups. In many instances, simply by having a backup copy, you can then erase the drive, reinstall the operating system, restore the backup copy, and then start fresh. So remember:  no backup, no protection from ransomware.

2.      Think redundancy. Most experts say you need to have three forms of backup: realtime, daily incremental, and weekly incremental. One of the three should be offsite with a cloud provider and the other two can be at different spots at your company, or at two separate locations.

3.      Isolate your backups. The backups should not be connected to a shared drive. Sure, you can be infected with ransomware during a backup session, but you really hedge your bets when you isolate exposure to just when you run the backups. Also, ransomware can infect both mapped and unmapped drives, so your best bet is to separate your backup drives from the network.

4.      Take snapshots. By creating snapshots of the incremental updates, the attackers may still have access to recent updates, by they won’t have access to the previous incrementals.

5.      Automate patching. US-CERT reports that proactive patching can eliminate 85% of cyberattacks. This includes ransomware, so patch Windows or the core operating system as well as any third-party plug-ins you may use. Remember that the attackers start by looking at third-party apps and applications that are not used that frequently. In fact, if there are applications you don’t use that frequently, disable them and enable them only when you use them.

6.      Educate everyone. It’s important to make your staff aware of these threats. Start by doing a baseline, sending a simulation via email to see how many people clicked on the test email. Odds are the percentage of those who clicked will be high to start. Then train everyone with online simulation tools, making it engaging and getting everyone in the company involved. Finally, run random simulations that the staff knows is coming, but don’t reveal the timeframe. Over several months, the staff’s percentages will improve and you would have more than likely prevented a ransomware attack.

Related Content:

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!