A company’s IT systems can become infected by ransomware in many ways. Most commonly, businesses are exposed to ransomware through phishing emails, also known as social engineering. These emails are often sophisticated and highly targeted, designed to manipulate unsuspecting employees into clicking malicious links or attachments to infect the entire network.
Recently, ransomware has also infected a huge number of business networks by exploiting common vulnerabilities in web servers as a point of entry. The 2022 Annual Cyber Threat Report, developed by the Australian Cyber Security Centre, cautions that ransomware attacks remain high, and also likely to be significantly underreported.
To combat this increase, the newly introduced Ransomware Payment Bill aims to impose a ransomware payment notification scheme whereby government agencies and businesses that turnover more than A$10 million will be required to notify the Australia Cyber Security Centre before paying a ransom.
How is ransomware a threat to SMEs?
It’s a common myth that only large companies are impacted by ransomware. An August 2023 study has revealed a 204% increase in total ransomware victims from the previous year (Q1 2022), with the majority of targets being small-to-medium businesses.
Ransomware has become extremely harmful to all businesses, contributing to 81% of financially motivated eCrimes globally. This form of cyber attack can cripple IT systems, websites, customer data and payment systems. Ransomware poses a major operational risk to businesses of all sizes, industries and revenue. A ransomware attack would threaten the financial stability of a small business due to the loss of revenue, IT recovery costs, network remediation and cost of paying the ransom if the business chooses to do so. A recent survey found that the average ransomware downtime cost was US$274,200 (A$377,700) for small and medium businesses in 2020.
Methods to mitigate Ransomware
1. Provide formalised phishing and cyber security awareness training to all employees
Teach employees how to identify malicious emails and, where possible, report suspicious emails to IT or senior management. This will help to reduce the likelihood of employees exposing the business to infectious websites or email attachments, as recent data has shown that 54% of ransomware attacks are caused due to phishing emails.
2. Flag all emails which originate from outside of the organisation
Incorporating an automatic alert on all external emails can help prevent hackers from impersonating internal staff and attempting to gain system access to perform funds transfer fraud.
3. Use antivirus and anti-spam solutions
Implement a spam filter to prevent the majority of phishing emails from reaching the network.
4. Enable multi-factor authentication
Using multiple layers of verification to confirm an employee’s identity whilst logging in can increase network security in the face of weak passwords and increased endpoint vulnerabilities caused by working from home.
5. Complete regular patching of all hardware, software and operational technology
This can help to prevent hackers from targeting common software vulnerabilities with malware in order to gain control of a company’s network and data. These exploits are perpetually discovered by criminals and can be greatly reduced by deploying critical software patches.
6. Follow the principles of network segmentation and least privilege
Restricting local admin privileges as much as possible ensures that if credentials are compromised, hackers are vastly restricted in their ability to move laterally or cause further network disruption.
7. Maintain system backups
Maintaining an up-to-date offline copy of critical system data does not prevent an external threat but often gives more options to organisations when determining whether they want to negotiate with the cybercriminals or attempt to rebuild the system themselves.
Why is cybersecurity insurance crucial in mitigating ransomware?
Cyber insurance responds to claims made by victims of a ransomware attack. This includes:
- Immediate 24/7 access to incident response services following an actual or suspected cyber event
- Ransom payments and access to specialist ransom negotiators (where it is legal for insurers to pay a ransom)
- Loss of profit related to business interruption following a ransomware attack
- Costs to repair and restore IT systems and data.
It is critical for businesses to take proactive measures to help manage their cyber risk, including the implementation of cyber insurance cover. A cyber insurance policy is an extremely valuable risk transfer tool for every business. With a cybersecurity insurance policy in place, access can also be made available to cyber security training modules and risk awareness videos as part of your business policy, helping your business and your team to identify and prevent cyber attacks.
The threat of ransomware is continually evolving in complexity and frequency, meaning that no business is safe. Protect your business from ransomware attacks today by talking to a cyber-risk expert for a solution to help keep your company safe.
