We have helped several companies recover from ransomware attacks this year.

The business segment is becoming an increasingly attractive target for cipher-malware developers, Kaspersky Lab says in a new study. According to the report based on Kaspersky Security Network (KSN) data, the number of attacks against the corporate sector 2015-2016, compared with 2014-2015 has grown six fold (from 27,000 to 158,000). Thus, ransomware tried to encrypt the data of every tenth B2B user.

Cyber-criminals using ransomware now attack businesses frequently, particularly small and medium-sized companies. This trend is confirmed by the IT Security Risks 2016 study from Kaspersky Lab and B2B International, during which 42% of respondents from small and medium-sized businesses agreed that cryptomalware was one of the most serious threats they faced last year.

For s companies, any data unavailability – however brief – can lead to significant losses, or bring their entire operations to a halt. If a company has not been taking due measures to ensure the safety of its important information, purchasing the decryption key from cyber-criminals can be the only way to recover data.

However, this does not guarantee complete data recovery. The best way to protect your company from malware is to prevent the attack in the first place.

Kaspersky Lab experts recommend several simple safety rules:
-Make regular backup copies of all important files. Companies should have two backups: one in the cloud (for example Dropbox, Google Drive, etc.), and another on an additional server or on removable media if the data volume is not too big.

Synergy’s guide is the 3-2-1 rule
– 3 copies
– on at least 2 media
– 1 of which is held remotely i.e. offsite

1. Compromised servers selling for $6 in IT underground market
2. Kaspersky: 35% of people in UAE are likely to accidentally share confidential data
3. USB charging creates mobile security risk, says Kaspersky

Trust well-known and respectful service providers who invest into security. Usually you can find security recommendations on their web-sites, they publish 3rd part security audits on cloud infrastructure. Don’t assume cloud provider can’t have security, availability or data leakage problems. Raise a question what do you do if security provider losses your data. There should be transparent data backup and restore processes together with data protection and access control.

Avoid using only free security and anti-malware software: small businesses expect the basic security tools offered within free solutions to be sufficient. Free tools do provide basic protection, but they fail to provide multi-layered security support. Instead, take a look at dedicated solutions: they do not require a large financial outlay, but deliver a higher level of protection. Some ‘free tools’ may be provided by the hackers.

Regularly update your OS, browser, antivirus, and other applications. Criminals use vulnerabilities in most popular software to infect user’s devices.

Prevent IT emergencies – configure security solution for your company. Small businesses usually don’t have an IT department or full-time dedicated administrator, they simply rely on the techiest person in the office to take care of the computers, in addition to his regular duties. Don’t wait until something breaks, use IT support from an IT service provider to review your software and security configuration in advance.

“Crypto-malware is becoming more and more serious threat, not only an organization losses money for ransoms but business can be paralyzed during files recovery. There is wide attack vector including web, mail, software exploits, USB devices, and others. To avoid infection, you personnel should explain where attacks come from and that employees should not open email attachments, visit untrusted web resources or plug USB devices into unprotected computers. Anti-malware solution is an essential measure to avoid majority security incidents”, noted Konstantin Voronkov, Head of Endpoint Product Management Kaspersky Lab.

I ran across a piece last week that noted 10mm Android phones have malware that has rooted their operating system. For the most part this malware is designed to show ads and install apps. Mobile devices are becoming ubiquitous, for everyone. It’s not just technical people that now have access to internal systems from mobile systems as everyone from low level marketing people to high level executives is becoming comfortable with accessing information regularly, from anywhere, at any time. This means that our security is inherently weaker because we allow access and with BYOD spreading this problem looks to get worse before it gets better..

One of the constant challenges with the spread of data breaches is establishing what is indeed data hacked out of an organisation versus data from another source. Many recent cases where representations of a data breach were made turned out subsequently to be wrong. For example, the recent case where it was claimed that 272 million accounts had been stolen from Hotmail, Yahoo, Gmail and Mail.ru. The mail providers subsequently confirmed that this was not the case. Same again for recent claims that there were 32 million Twitter accounts on the loose. Twitter quickly debunked this and speculation that they were obtained via malware has never been substantiated.

The basics of security are still woefully weak. Many sites only allow you to create limited length passwords or to enter weak passwords such as pwrod123, or ******, etc. This implies they’re trying to fit the password into that varchar(10) column in the database thus implying no cryptographic storage, and it fundamentally weakens the choice of passwords available to the user. E.g. see the Etihad site, or KLM flying blue. Other airlines are equally lackadaisical and there many other security flaws easy to find. PayPal will also truncate long passwords but without telling you – so you might find yourself locked out because your entered password is too long

A recent data back up mantra I heard that is worth repeating is the 3-2-1 approach:
3 copies of data
on at least two media
one copy held remotely
.