Editorial · May 9, 2017
Ransomware Protection: Backup Steps for Small Firms
Ransomware protection starts with one habit: keep a recent copy of your files that the criminals cannot reach. Ransomware is software that locks your files and demands money to open them. If you hold a clean backup, you can restore your work and skip the payment. This guide lists the steps that US government agencies were urging businesses to take as of May 2017.
What ransomware does to a small firm
Ransomware is malicious software that restricts access to a computer until a ransom is paid. Often it encrypts your files, so they cannot be read. A message then tells you to pay, usually in Bitcoin.
The cost is not small. The Federal Trade Commission wrote in November 2016 that criminals typically ask for $500 to $1,000, and some have demanded as much as $30,000. A Southern California hospital lost its network for more than a week in February 2016 and paid a $17,000 ransom. Ten hospitals in the Washington, DC area were crippled for nearly two weeks.
This is not only a hospital problem. The FTC said it affects businesses across the economy, and that nobody is immune. A firm with ten staff and one shared drive can lose a week of work.
How it gets in
Most attacks begin with a person clicking something. One panelist at an FTC workshop said 91 percent of ransomware arrives through phishing email. The user opens an attachment or follows a link, and the harm starts.
US-CERT describes other routes. Drive-by downloads install software when you visit an infected website. Variants such as Locky spread in spam email through Microsoft Office files with macros or zipped attachments. Another variant, Samas, spreads through web servers that have known holes, then moves into the wider network.
Some versions also encrypt files on shared and network drives, not only on the infected computer. That is why one bad click can reach the whole office.
Backups: the core of ransomware protection
US-CERT puts the backup first. Its advice is to keep a data backup and recovery plan for all critical information, and to run and test regular backups. A backup you have never tried to restore is a guess, not a plan.
US-CERT also warns that backups connected to the network can be hit too. It says critical backups should be isolated from the network for the best protection. In May 2016 the agency clarified this very point in its alert. The FTC panelists said the same thing: keep backups disconnected from your network so you can rely on them in an attack.
- List the files the business cannot run without, such as invoices, customer records and payroll.
- Copy them on a regular schedule. Daily is better than weekly for active files.
- Keep at least one copy on a drive or service that is not always attached to your network.
- Once a quarter, restore a few files from the backup to prove it works.
Patching and software limits
US-CERT says vulnerable applications and operating systems are the target of most attacks. Keeping them up to date with the latest patches shrinks the number of doors an attacker can use. The FTC added that a company that fails to patch holes known to be used by ransomware could face questions under Section 5 of the FTC Act.
Other steps from US-CERT are simple to adopt:
- Keep anti-virus software current, and scan files you download before you open them.
- Give each user only the access they need. This is called least privilege, and it limits how far malware can spread.
- Do not enable macros in email attachments. Enabling a macro can run the hidden code.
- For larger offices, consider application whitelisting, which lets only approved programs run.
Staff habits and an attack plan
The FTC panelists urged firms to train employees to be careful online. Teach staff not to follow unsolicited links in email and to treat unexpected attachments with suspicion. A short talk twice a year costs little compared with a week of lost work.
Write a response plan too, and test it. The FTC lists three steps if an attack hits. First, put your continuity plan to work. Second, call law enforcement, such as a local FBI field office. Third, disconnect the infected computer from the network at once, so the malware cannot reach shared drives. US-CERT asks victims to report fraud to the FBI through its Internet Crime Complaint Center.
Should you pay? Most panelists, including law enforcement, do not condone paying. US-CERT says payment does not guarantee the files will be released, and it only guarantees that the criminals get your money. A tested backup is the best way to avoid facing that choice.
A one page checklist
- Back up business-critical files on a set schedule.
- Keep one backup offline or disconnected from the network.
- Test a restore every quarter.
- Install software patches as they come out.
- Limit user permissions and block macros in email attachments.
- Train staff to spot phishing email.
- Write down who to call, and who unplugs the infected machine.