The global ransomware cyber-attack on 12 May affected at least 250,000 computers across circa 150 countries by exploiting known vulnerabilities in older versions of Microsoft Windows operating systems. The fact that the attackers targeted mostly hospitals and government agencies may bring some misplaced comfort to the owners of Irish SMEs. The cyber-criminals took aim at large public entities so they clearly have no interest in the operations of mid-sized, Irish entities, right? Wrong.
If cybercrime is a new family of crime, then ransomware is the latest terrifying addition to the clan. Barracuda, a leading technology security provider, see ransomware as the number one IT security challenge facing organisations in 2017. In real terms, the reported incidence of ransomware attacks increased by approximately 300% between 2015 and 2016.
So, what exactly is ransomware? Put simply, it is a subset of malware which the criminals use to locate and encrypt your most critical data. They then offer to provide a key to unlock your data if a ransom is paid within a specified time frame. It’s a very simple business model. The FBI has indicated that over $200 million was paid in such ransoms in Q1 of 2016 alone, and this is probably only a fraction of a larger sum due to the understandable under-reporting of the crime.
In an age where business is becoming increasingly dependent on technology, the likely disruption to customers, the potential financial cost, the possible reputational damage and the regulatory ramifications of a potential data breach (GDPR is on its way!) arising from such an attack has sparked a significant increase in information security spend by many organisations as they seek to defend themselves in the face of ever increasing cybercrime. Hence, we are locked in a new race where resourceful public and private entities try to stay one step ahead of the faceless cybercriminals who reinvest the ransoms paid to stage their next attack. In such a scenario, small and medium businesses who do not have the technical or financial resources to protect themselves, as effectively as their larger peers, become an easy, accessible target for those engaged in what is the scalable, profitable and borderless ransomware business.
So, how does an Irish SME protect itself from becoming the next victim of ransomware? Here’s an eight-step checklist which SMEs can adopt to mitigate the risks posed by cybercrime:
Keep software updated, since updates often include security patches. Last’s week’s attack, in common with almost all such instances, exploited known vulnerabilities;
Educate all staff, on a recurring basis, regarding the risks and how to protect themselves and the business. Many cybercrimes are predicated on anticipating or influencing user behaviour;
Force the use of strong passwords, which are regularly updated, for all applications, not just key applications such as banking or invoicing;
Use up-to-date security solutions including anti-virus, firewalls, intrusion detection, and threat detection. Figures published by Osterman Research Inc. show that three sources combine to account for some 83% of all ransomware malware entering organisations being email (31%), email attachments (28%) and websites/web applications excluding email (24%);
Never click on links to banking sites in emails or texts. If in doubt, call the bank directly;
Treat mobile devices the same way you would treat computers; they are equally, if not more, vulnerable to attack;
Ensure your files are backed up regularly and reliably. You may lose data at any time not only as a result of crime; and
Get professional, external advice to improve your security. Conducting a risk assessment is a sensible first step.
You cannot eradicate the risk of falling foul of a cyber attack but let’s all work to make it more difficult for the bad guys.
Terry McAdam FCA is the Consulting Partner in RSM Ireland.