Now more than ever, we are all exposed to a greater risk of having our data compromised. The risks come in many forms such as viruses, malware, data leaks and hacking to name a few. Right now, the spotlight is on what many perceive as being a new way for hackers to gain access to your data by exploiting vulnerabilities exposed by outdated software.
Ransomware is actually a lot older than you might think with cases dating as far back as the late 1980s. Despite this, most individuals and businesses live on the edge when it comes to protecting themselves from being held to ransom for their own data. As of 27th June 2017, US$ 130 000 in Bitcoin payments were recorded for the WannaCry attack which warrants the question: Would you pay to get your data back? Sadly, there is no guarantee that even if payments are made that the hackers will honour their “promise” to provide a decryption key.
The closest thing to a guarantee you will ever get is doing as much as you can to restrict exposure and avoid infection altogether. My advice to you would be to ABUSE the system.
ABUSE is an acronym for Activate, Backup, Update, Secure, Educate which I will now break down for you.
We’ve all at least thought about getting a cracked copy of that vital piece of software because it’s simply too expensive to buy. In South Africa for example, a licensed version of Windows 10 Home edition retails for around R1500. The issue with cracked software (apart from the question of legality) is that often the mechanism used to crack it leaves a gaping back door for hackers to get into your systems, or the crack itself is a virus. Since it can cost upwards of UD$300 (that’s about ZAR4500 in today’s money) to get your data decrypted if infected with WannaCry, surely it makes financial sense to make sure your software is genuine?
This is an obvious one. Backing up protects you from hardware failure, theft and to a certain extent virus infection. With the availability of cloud services such as Dropbox, many assume that using such a service is a secure way to back up your data. While this can help in protecting you from theft and hardware failure, these kinds of mechanisms tend to synchronize compromised data, spreading it across multiple devices and can even act as a catalyst to destroying even more data. The age-old 3-2-1 rule is really the only full proof method of ensuring recovery after data loss. So, make sure you have 3 copies on two different types of storage with at least one of them being kept offsite and where possible use backup software to handle your backups for you. Veeam Endpoint, for example, is a free backup utility that automatically performs backups which are secure and easily recoverable.
Many organizations choose not to update their software and operating systems because of possible downtime and cost of doing so. The risk here is that ransomware attacks like WannaCry exploit weaknesses that are usually rectified by regular updates, in this case, an update was released by Microsoft in March of this year, nearly 3 months before WannaCry made headlines. A lot of money and heartache could have been spared.
Probably the most obvious yet misunderstood aspect of protecting your data is the security aspect. This is largely because people assume that if you have an anti-virus installed and up to date, then you’ve done what’s needed to keep yourself from being infected. While traditional antivirus software does offer a level of protection, there is a reason why you get free versions and paid versions of the same software. Paid versions bundle antivirus with antimalware, a firewall, internet browser plugins among other things that add another level of protection. There are also technologies like two-factor authentication, virtual private networks, data leak prevention, poison pills and many more that can ensure your data is watertight secure. A phenomenon like BYOD add further exposure because if anyone can plug into your network, do you really know what their device is exposing your network too?
Possibly the most important of all points in the ABUSE system is to stay informed and educate your staff about data security. Hackers use day today productivity tools by sending phishing emails and hiding macros in office documents to plant their seed. A simple click of a button can potentially bring an entire organization to its knees.