Reading Time: 4 minutes

Ransomware is type of self-propagating malware that encrypts your files so that you cannot read or use them until you pay a ransom. Yeah, I know, I can feel how you are rolling your eyes at that unhelpful explanation full of incomprehensible technical jargon. So let me explain these terms in more detail.

MALWARE

Malware is a contraction of the term malicious software. This is a piece of software, or application, that is written with the sole purpose of being malicious and doing malicious things. Exactly what malware could do to you is wide ranging and practically anything, it is usually something destructive such as deleting files or something nefarious like stealing your files.

Malware frequently masquerades as something fun or something useful. For example, a simple computer game, while you are having fun playing the game, the game is deleting all your files. I’ve even known of malware masquerading as malware removal software. How this works is through one method or another, frequently email or web page, you are enticed to install this free tool to check for malware on your computer. While the application pretends to be scanning for malware it is scanning for files to steal/destroy. Pretty nasty stuff.

SELF-PROPAGATING

This is any software that will discover other computers nearby and install itself on all of them without any user involvement or knowledge. For example, if you have a self-propagating malware on a laptop that you take home and connect to your home network, it will discover all the other computers in your home and install itself on them. So, your spouse’s laptop, your kids’ computers, etc., all now have the same malware.

This typically happens due to un-patched vulnerability in the operating system of the computer. That is to say, for example, your version of windows might have a flaw in it that the malware is using to distribute itself to other computers with the same flaw. These types of flaws are typically fixed soon after they are discovered. These fixes are known as patches or updates. This is the reason it is important for the security of your computer to install these patches or updates when they come out. Make sure though, that you only install the authentic update from software vendor, i.e. Microsoft, and not malware masquerading as an update. If you need help with this part make sure to reach out to a trusted adviser, someone that can be trusted with the security of your computers.

ENCRYPTION

This is a rather complex topic that will require its own article. What you need to understand here is that by encrypting your file they become locked and unusable until the person or application that encrypted (i.e., locked) it, decrypts (i.e., unlocks) it.

RANSOM PART OF RANSOMWARE

OK now that I’ve explained what malware is and how it distributes itself let’s talk about ransomware itself and what makes it so dangerous.

What makes ransomware so different from other form of malware is how it holds your files (documents, pictures, etc.) hostage until you pay an outrageous amount of money to the author. This is similar to old fashion kidnapping. Bunch of criminals kidnap someone they think is loved and has a lot of money, then they keep them hostage until they are paid a lot of money for their safe return. Same thing happens here. Once the ransomware malware has been installed it starts to scan your computer and all storage devices and storage services it is connected to for files it thinks may be important enough for you to be willing to pay ransom for it, this can be every user generated file. Then they lock the files so you can’t get to them and pop up a message with the ransom demand when you try to access them. The ransom demand promises that once you pay the ransom, you will get an unlock key that will allow you to unlock the documents. Depending on the type of ransomware sometime the criminals maintain a remote connection to your computers and promise to unlock your files remotely once you pay the ransom. Now the topic of whether to pay the ransom or not and whether their promises are to be believed are hotly debated topics. Suffice it say that the prevailing advice regarding ransomware is very similar to prevailing advice regarding paying kidnappers, that is to say don’t do it. The final decision on whether to pay should reside with data owner as they are the only ones who understand the value of the locked data.

If you have made the proper preparations ahead of time the debate of whether to pay or not tends to be moot as you can just recover your files. How all that works is the topic of the next blog in this series.

WHY THIS MATTERS

Ransomware crime is on a sharp increase and projected to become #1 internet crime. According to the US Federal Bureau of Investigation Internet Crime Complain Center, or FBI iC3, 2020 Internet Crime Report available at https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf, ransomware reports have increased from 1493 in 2018 to 2474 in 2020, and aggregate ransom has increased from 3,621,857 USD in 2018 to 29,157,405 USD in 2020. While 2021 numbers won’t be available until sometime in 2022, they are expected to be multiples of 2020 numbers. Therefor it is important to be aware of this threat and be able to protect yourself from it.

Reading Time: 4 minutes

HOW TO PROTECT YOURSELF FROM RANSOMWARE

Protecting yourself from ransomware falls into two main buckets, first is steps to take to avoid getting infected, second is being prepared to recover should you be so unlucky to get infected despite defensive measures. In this article I will touch on defensive measures while deferring detailed coverage on that to a separate article. The focus of this article will be how to set yourself up so that you can recover from infection.

RANSOMWARE DEFENSES

Most ransomware infection these days occurs via email attachments or links in email. Defense against that is twofold

• Ensure you have a high-quality antivirus/anti-malware software on all computers
  • Ensure it is kept up to date, updates are often daily
  • Ensure it is configured correctly
• Educate yourself and your users on how to avoid falling for phishing emails
  • Don’t open attachments or click on links in emails that are unexpected, or you aren’t absolutely 100% sure are authentic.
  • Look for other articles from us in the future with more details on this.

If you need help with these steps reach out to a trusted advisor, someone you trust to take good care of your computers and ensure their safety.

RANSOMWARE RECOVERY PREPARATION aka Importance of backups

The best way to prepare to recover from a ransomware event is to ensure you have a solid backup in place. How you do your backups makes a big difference in recoverability.

While backing up to an external hard drive or network share is great for things like failed hard drive or accidental deletion it is useless when it comes to ransomware events or other malicious events as that will get encrypted/deleted along with your local hard drive.

For smaller organizations and individuals, leveraging Microsoft OneDrive built in ransomware protection is often sufficient. Follow this link for more details on how this works.

For larger organizations, they are going to need some additional backup processes, so here are some recommendations for how to set things up for maximum recoverability. Use this guide either for your own setup or when interviewing trusted partners to host your environment to ensure they are thinking about the security of your infrastructure.

• First step is to select a reliable backup solution that stores the backup off-site and packages the files into archives that are completely separate from files that are being backed up. Additionally, ability to encrypt the backups, is an important security consideration.
• Storing the backups at a location other than the files being backed up is more important to disaster recovery than ransomware recovery. Since you are going through the effort to back up your files, it makes sense to consider all hazards, not just one. If you store the backup in the same location as the files being backed up, and something happens to that location such as fire, earthquake, tsunami, etc., you’ve lost both the original and the backup. When selecting storage location for the backup don’t pick a location in the same town even, pick a different hazard zone where the same event can’t take out both locations. This typically means storing the backup in a different region, for example if your files are stored in the south, store the backup in the north.
• Make sure to enable strict separation of duties. The account that has access to the backup system, that can restore backups or even just view or make changes to the backups, should not have access to any of the systems being backed up. Anyone with access to make changes to any documents being backed up, should have no access to the backup systems or the location where the backups are being stored. Backup operator should not be able to access any files in each backup, they can see the file names, paths, and other meta data like that but not the content. Restored system should have the exact same permissions as the backed-up system. For smaller organizations balking at needing a separate backup person note that I am talking about the accounts needed, not persons needed. Backup operator can have other duties, they will just have to use a totally separate account when doing their backup duties.
• Make sure you test your backup. The backup is not useful unless you know for a fact you can restore it. You do not know for a fact that you can restore a backup until you have in fact restored it. This is the most common failure when it comes to backups.
• Make sure your backup schedule accounts for the frequency your data is changing. In other words, think about how much work you are willing to lose and backup that frequently.
  • If you only backup once a week, you lose one weeks’ worth of changes if you need to restore a backup. Nightly backups are very common, as that means you only loose few hours’ worth of changes and getting through an entire backup set in a night is typically feasible for most cases.
  • This is usually restricted to how long it takes to perform each backup cycle.
  • Low-cost systems are typically very slow, and fast backup systems are typically very expensive.
  • So, if you are purchasing your own backup system you have to balance how frequently you want to backup with how much you are able to spend on backup systems.

Recovering from Ransomware infection

The single best step in recovering from any sort of infection is something referred to in the industry as flatten and re-image. This consists of completely erasing the infected hard drive of all data to a point where it is squeaky clean with absolutely zero on it. Then reinstalling the operating system and all applications from original installation media, followed by restoring the backup of the data on that computer.

If it is desired to understand how the infection happened, it is important to simply turn off the computer, unplug it and hand it over to a digital forensic specialist as soon as the infection is discovered. This can be a very costly process and not worth it in many cases. For most best course of action is to go straight to flatten and re-image.