Table of Contents

    About the Author

    Jon Matthews

    Jon Matthews

    Jon Matthews is a highly experienced and trusted leader in computer and network forensics with over twelve years of experience. He leads investigations around high-profile digital forensic and incident response matters helping clients determine the root cause and extent of breaches. Jon retired from the U.S. Army with over 20 years of service. He was a Special Agent with U.S. Army Counterintelligence for nine years and specialized in digital forensics for espionage and APT investigations. Jon also worked with Aon's Cyber Solutions (Stroz Friedberg) leading their Washington, DC forensic lab and conducting digital forensic and incident response investigations for two and a half years. Education, Certifications, and Training: Jon holds a Bachelor of Science degree in Computer Networks Security from the University of Maryland University College, and holds a Graduate Certificate in Incident Response from the SANS Technology Institute. Jon was a certified Computer Crime Investigator while working in the U.S. Army. His certifications include being a CISSP, Certified Incident Handler, Certified Forensic Analyst, Network Forensic Analyst, Reverse Engineering Malware, Advanced Smartphone Forensics, Certified Ethical Hacker, Secure Infrastructure Specialist, A +, Network +, and Security +.

    More Articles

    Additional Resources:

    5 Steps to Implementing Continuous Threat Exposure Management in Your Organization

    5 Steps to Implementing Continuous Threat Exposure Management in Your Organization

    Articles

    5 min read

    Cyber Insurance Challenges: Why Premiums Are Rising, and Coverage Is Harder to Obtain

    Cyber Insurance Challenges: Why Premiums Are Rising, and Coverage Is Harder to Obtain

    Blog Post

    5 min read

    The major shift to digital everything over the last two decades has been nothing short of remarkable. Information is able to exist in small data packets that can travel almost instantaneously to the other side of the world.

    From major corporations to local mom-and-pop shops, it seems as if everyone is storing most of their data online – inventory and pricing data to more sensitive data such as financial and identification data makes up some of the information that can be stolen.

    While the digital ecosystem has many benefits, there are also major data security challenges that businesses should be prepared for. One of those challenges is ransomware.

    What is Ransomware?

    The term “ransomware” originated as a way to describe software that restricted access to a computer system or encrypted data on it, demanding payment for its release. Ransomware is a type of malware that installs covertly on a person’s computer and blocks the use of that computer system until the victim pays an amount to the attacker.

    The coronavirus pandemic prompted many organizations to enact remote work policies — which, in turn, made them more vulnerable to cyberattacks. Ransomware attacks rose by 92.7% in 2021 compared to 2020 levels, with 1,389 reported attacks in 2020 and 2,690 in 2021.

    The reasons for this are not hard to fathom. Ransomware, like all forms of extortion, puts its victims in a bind: pay up and your data is released; don’t and it’s encrypted permanently, or at least until some time goes by when you might be able to recover it through some other means. Threat actors may also threaten to release the data if they suspect that the victim has adequate backups of the data.

    It’s easy to see why many businesses decide that paying the ransom is the path of least resistance — especially when they have no backup data or other alternatives to keep their business (and reputation) intact.

    While paying up may be tempting, it only serves to encourage more ransomware attacks, because it makes them profitable for the attackers behind them. As long as there are ransoms being paid, people will make money by deploying ransomware.

    Facts About Ransomware

    • Costly Extortion: A survey conducted by the International Data Corporation found that the average cost of a ransomware attack was $250,000. In addition to expensive extortion fees, these attacks are also measured in the costs attributed to business disruption and downtime. With larger corporations or organizations, the total cost can add up to millions in no time at all.
    • Deal with the Devil: There are no guarantees when you pay a ransom to a hacker that you will get your files back or that they will not attack you again after getting your money. The FBI advises against paying ransomware demands as it encourages future attacks and provides funding for criminal activities.
    • User Error and Phishing: The common means hackers gain a foothold is done via malicious link propagation. For example, when an unaware user at a business clicks a suspicious link in their spam e-mail, a ransomware security breach can get triggered, compromising precious key data and operation time.
    • Untraceable Payments: In most cases, hackers demand payment in specific cryptocurrencies because it can be untraceable and difficult to recover. However, this may be changing as some payments have been tracked by law enforcement.
    • Software Vulnerabilities: Software vendors release updates regularly, which include security patches for known vulnerabilities of their software products. If users fail to install these patches on time, they become vulnerable to attack through any known vulnerabilities that have been found and patched in these updates, leaving their systems open to be exploited by malware like ransomware.

    What Can Be Done to be Protected Against Ransomware?

    If there’s a silver lining to be found in this grim picture, it is that an organization can greatly reduce its chances of becoming a ransomware victim by taking a few simple precautions:

    • Back up your data regularly, preferably on a cloud-based solution or some other offsite location
    • Inside your network, segregate your valuable data from less sensitive information so attackers can’t just steal everything if they gain access
    • Keep your software up-to-date so security flaws can be patched quickly
    • Train employees and other users on the pitfalls of ransomware and the importance of being diligent against these threat actors
    • Hire an MSSP like CyberMaxx to protect your network, utilizing services like Network, MDR, and EDR to name a few

    Knowledge is power, and educating yourself about the threat posed by ransomware — and what you can do to protect yourself against it — will help put you in a better position than most if you are unfortunate enough to face an attack.