Taken hostage: ransomware and cyber risk management.

• Author: Werner, Randy
• Position: Tech Talk

[ILLUSTRATION OMITTED]

Ransomware and cyber extortion represent one of today's more malicious types of hacker attacks. It sneaks into computer systems, encrypts files and demands a ransom before decrypting the files. A major problem is that ransomware does not always decrypt files even after the ransom is paid. Being prepared and taking precautions against risks such as ransomware is essential. Otherwise, you're at the mercy of criminals who prey on unprepared and unsuspecting businesses and individuals.

Ransom demands range from a few hundred dollars to several thousand, depending on the size of the victim. Not all ransomware attacks are reported to authorities, so estimates of the total amount paid over the past few years vary widely, ranging up to $300 million. The more notorious names among ransomware are CryptoLocker, Crypto Wall, TorrentLocker and Locky, among others. Some attacks rely on software that now has known fixes, so a solution might be found online. However, other ransomware is more technically advanced and has no known fix, except for the victim to rely on backup files.

The primary defense is to institute frequent backups of the files you want to preserve. Some ransomware even seeks backup copies of files, so best practices include creating multiple backups in different locations. Cloud services, or remote backup services, and external or USB hard drives are options to consider for multiple backups.

Even with backup files in place, a firm may still spend many hours gathering, reentering and reconstructing data. Rebuilding work, such as tax returns based on the backups, also takes time. If personally identifiable information is involved, such as Social Security numbers, the firm might also need a professional risk assessment to determine its legal responsibilities.

Such losses can sometimes be avoided by creating user awareness, along with training everyone in your firm to be cautious about unsolicited or questionable attachments or links in email messages. Training can broaden your firm's prevention IQ. It also never hurts to call or contact senders to ask if they sent you a document before you open it. Sometimes ransomware enters a computer system via innocuous Word or Excel documents. There's a reason why people say, "An ounce of prevention is worth a pound of cure."

Loss Prevention Tips

* Create backup copies of all important data and information on a regular basis. The frequency of backup depends on how often your data...