Ransomware has become a household word recently. With the attacks on American Healthcare facilities, large school districts and America’s core businesses, we have all unfortunately learned that ransomware is dangerous and lucrative to the criminals. These hackers are gaining millions of dollars every month from locking up unsuspecting victim’s files.

Just today, in a group that I am a member of on LinkedIn, there was a post looking for help after files had been encrypted. Once the files are encrypted IT IS TOO LATE. Even the FBI has said that the SHA-256 encryption is too good to crack and that you should pay to get your files back.

Businesses must act BEFORE an infection. This is a definite case of “preparation is key”. I talk to more than 3 businesses each week that have been affected. They all didn’t believe they were a target for hackers. They all say the same thing “I didn’t think this could happen to me.” Most are small business owners who generally have a false sense of security or have taken the “head in the sand” approach.

There are three key things you can do to protect yourself from Ransomware. I recommend you act today to implement these three key strategies.

1. Backups. This is kryptonite to the ransomware epidemic. If a business has up to date backups of their data, there is no need to pay to get it unlocked. A simple restore from the latest backup will have your files back in working condition in no time. The drawback is: When was your last backup? Is it an hour, a day or longer? You can only recover to the latest backup so make sure you are running them on a schedule that makes sense for your business model. You must also ensure that the ransomware is completely removed from enterprise systems and every endpoint. Just like a virus, it spreads polymorphically (changing and evolving) across the network infecting as many machines as it can. You have to have a removal strategy once infected. This includes segmenting affected computers, running in-depth malware, virus and rootkit scans to ensure the infection won’t come back.
2. Antivirus. You must have up to date antivirus running on every endpoint in the enterprise. From the point of sale system to back of house, every PC, Mac, server, and storage device must be running up-to-date antivirus. It is a good idea to have an antivirus monitor that tells you when machines are out of date or are not updating appropriately. There are some inexpensive antivirus monitoring tools out there that allow you to inventory your devices and also alert you to antivirus status. The drawback to antivirus protection against ransomware is that hackers are changing their algorithms every day to get around antivirus. Antivirus is signature based and it compares each file with known malware, viruses and ransomware. If you are unlucky enough to get a new variant, such as Locky, that is polymorphic or that is not known to your antivirus client, it still gets through. Due to the millions of infections each month, it is safe to say that not all antivirus is keeping up. With that being said, having up to date antivirus across the enterprise is one of the cornerstones of a solid cybersecurity strategy.
3. Firewall Protection. Firewalls are much different from antivirus because they inspect all traffic coming into the business. Depending on the firewall brand, such as Axiom, the firewall will have deep packet inspection and some other key features that will scan packets for threats. One thing at Axiom that we have found is the specific protocol level communication that happens when a ransomware is activated on your network. Ransomware must obtain a Private Key to complete the encryption process. Without the private key, ransomware simply doesn’t work. We have been able to identify that exact communication and we block it at the firewall. By doing egress monitoring (which is doing deep packet inspection on traffic leaving the business) we can empirically stop ransomware from encrypting your files.

All of Axiom’s firewalls do egress monitoring, deep packet inspection, SSL DPI, and many other enterprise features. Our business model allows us to send out a fully configured firewall for your business. It is plug and play to install, such as plugging in a wireless router. We then manage it, monitor it and keep you up to date every single day with the new emerging threat definitions. There is no upfront cost for the device, just a monthly subscription for the monitoring and updating. You can save thousands over the cost of other firewalls, installation, configuration and maintenance from our competitors.

Most small businesses can’t afford a full-time IT staff, much less a cybersecurity expert on staff to keep the business protected. Call us today for a free consultation that is specific for your business. Our cybersecurity experts research the latest emerging threats and we update our firewalls each day to keep our clients on the cutting edge of protection. Our firewalls are unique in the fact that they don’t have to be restarted to be updated. Our firewalls are one of small group of security appliances that inspect traffic in both directions, going into and leaving the business.

Call us today for your free consultation.
1-800-519-5070 | www.axiomcyber.com

Imagine the following scenario. You receive an e-mail that appears to be from, for all intents and purposes, your superior. There’s a familiar link to a payroll policy update included and you click to investigate. Soon after, a pop up has appeared on your computer screen informing you that your system and data are locked – and access can only be restored if a payment is made. At this point, you realize that you have been infected with something and the only two options you have are to either pay the ransom, or to ignore it, effectively losing all of the data on your system and/or network.

This is a classic example of digital extortion by ransomware.  Ransomware is defined as a kind of malware that locks your computer screen and prevents you from accessing your data until you pay the “ransom” to the cybercriminal. Money of course is the motivating factor for these cyber criminals and ransomware is only increasing and making it easier for them to follow the money. A report by the Cyber Threat Alliance found that ransomware generated more than 325 million dollars in ransom income. Ransomware is only going to evolve. In fact, ransomware hackers are now threatening to publish your personal files on the web if you do not pay up. The threat of having your personal data and files in the public domain is terrifying for those who possibly have embarrassing or sensitive data.

It should come as no surprise that many businesses will choose to simply pay off the ransom. In fact, recent headlines show that even the FBI is encouraging people to pay up.

Recently, during the 2015 Boston Cyber Security Summit, Joseph Bonavolonta, an assistant special agent in charge of the FBI’s Cyber and Counterintelligence Program in the Boston office stated,

“The easiest thing may be to just pay the ransom. The amount of money made by these criminals is enormous and that’s because the overwhelming majority of institutions just pay the ransom.”

Ransomware relies on the human aspect and programs like antivirus protection are not guaranteed to stop ransomware. The FBI recommends the following tips to help avoid ransomware.

1. Make sure you have updated antivirus software on your computer.
2. Enable automated patches for your operating system and web browser.
3. Have strong passwords, and don’t use the same passwords for everything.
4. Use a pop-up blocker.
5. Only download software—especially free software—from sites you know and trust (malware can also come in downloadable games, file-sharing programs, and customized toolbars).
6. Don’t open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if you think it looks safe. Instead, close out the e-mail and go to the organization’s website directly.
7. Use the same precautions on your mobile phone as you would on your computer when using the Internet.
8. To prevent the loss of essential files due to a ransomware infection, it’s recommended that individuals and businesses always conduct regular system back-ups and store the backed-up data offline.

However, these tips still offer no guarantee that protects you from ransomware.

Axiom Cyber Solutions offers the Axiom Sentinel, an enterprise firewall and security appliance, to help with ransomware by making sure that criminals have no way to call home. Sentinel makes malware and ransomware communication out of your network impossible, rendering these applications ineffective and unable to encrypt your data. We have identified key transactions in the TCP/IP stack that must occur when a ransomware is executed. This allows us to block ransomware communication in real time.

Ransomware infections will continue to rise and will evolve with new social and technological attack vectors. It’s important for any organization or individual with sensitive data to exercise caution and deploy best practices in securing your network.

Axiom’s solutions come in different sizes and all of our solutions are designed to deal with the attack vectors of today while being adaptive and flexible enough to continue to secure your network for years to come. For more information, check out our website at axiomcyber.com or give us a call us at (800) 519-5070. #FightBackWithAxiom

Axiom researcher Linda Johnston, in Las Vegas, Nevada contributed to this article.