Data is the core of any business. Data is crucial for addressing client needs, running business operations, reacting to unexpected events, and responding to quick market movements. This makes data protection and management a high criticality for businesses. The increasing uncertainty around ransomware attacks raises this concern for data protection even higher. Data protection should indeed be the prime focus for today’s businesses.
COO, TechnoBind
According to recent Thales research, phishing, ransomware, and malware continue to be a major problem for multinational corporations. One in five (21%) businesses have fallen victim to a ransomware assault in the past year, with operations significantly impacted in 43% of those cases. Multiple loopholes in security infrastructure and pandemic-induced disruptions are the major contributing factors to the wider spread of ransomware attacks.
Data exfiltration, also known as “double extortion” ransomware, is becoming a widespread method used by many ransomware criminal groups, where they exfiltrate a victim’s sensitive data in addition to encrypting it giving them additional leverage to collect ransom payments. Again, ransomware attacks are no longer prevalent in one sector of businesses. It is rather devastating for SMEs, small businesses, and non-profits, who may not have the right resources in place against such attacks or save their data.
- Data Backup: It is a crucial step to always have a solid backup plan that has been tried and tested. The attack can be mitigated if organizations have a timely backup of their data and systems that can be easily reinstalled. It is highly critical to also ensure that the backups themselves are protected, as ransomware attackers are increasingly focusing on compromising the backups.
- Data Encryption: Encryption is the process of scrambling legible data so that only the owner of the secret code, or decryption key, can decipher it. It assists in ensuring data security for sensitive information. Data encryption is even specifically highlighted in the GDPR as a technique of data protection.
- Access Control: Adding access controls to a business’ workflow is a highly effective way to lower risk. The risk of a data breach is directly proportional to the lesser people that access the data. Businesses should make sure that only personnel with a justifiable cause should have access to critical information.
- Network segmentation: in which the network is divided into subnetworks and organizations have distinct segments, is a practice that organizations can engage in. This is helpful, especially when discussing lateral movement. If there is a separation, ransomware that has already infected your systems, it cannot spread to other subnetworks. As network segmentation and traffic monitoring go hand in hand, a solution to both problems would also be beneficial.
- Cyber Hygiene: A moral step in lowering the risks is to practice excellent cyber hygiene. Cyber hygiene is a set of routine behaviours that ensure the secure management of sensitive information and network security. It’s similar to personal hygiene, when you establish a pattern of quick, simple tasks to avoid or lessen health issues.
Apart from these organizations can foster cybersecurity awareness culture in general. Educate the staff to distinguish malicious emails. Employees should be vigilant and alert enough to detect irregularities in the communications they receive. These could be out of place emails coming from seemingly known sources, unverified domains, misspelled email IDs, unusual requests in messages, and persistent redirects to unusual websites can all be indicators of corrupted emails. Invest in security awareness training programmes so that staff may become more adept at handling phishing emails.
