What is ransomware? Everything you need to know and how to reduce your risk

Obviously, the most immediate cost associated with becoming infected with ransomware — if it’s paid — is the ransom demand, which can depend on the type of ransomware or the size of your organization.

Ransomware attacks can vary in size but it’s becoming increasingly common for hacking gangs to demand millions of dollars to restore access to the network. And the reason hacking gangs can demand this much money is, put simply, because many victims will pay.

That’s especially the case if a network being locked with ransomware means the organization can’t do business — it could lose large amounts of revenue for each day, perhaps each hour, the network is unavailable. This downtime can quickly add up to millions of dollars in losses.

Also: Faced with likelihood of ransomware attacks, businesses still choosing to pay up

If an organization chooses not to pay the ransom, not only will it lose revenue for a period of time that could last weeks, perhaps months, but it will also have to pay a large sum for a security company to come in and restore access to the network, and there may also be costly legal repercussions. 

Whichever way the organization deals with a ransomware attack, the incident also will have a financial impact going forward, because to protect against falling victim again, the organization will need to invest in its security infrastructure and handle legal costs, potential class action lawsuits, and regulatory fines.

On top of all of this, there’s also the risk of customers losing trust in the organization because of poor cybersecurity, with clients taking their business elsewhere.

Paying the ransom is discouraged by cybersecurity and law enforcement because it encourages cyber criminals to continue to launch ransomware campaigns. There are even instances where a victim has paid a ransom, only for the same attackers to return with another attack and demand another ransom payment.

To date, the largest ransomware payout to date was made by CNA Financial, one of the top US insurance providers. The organization reportedly paid out $40 million after falling victim to a ransomware attack.

To put it simply: Ransomware can destroy your business. Being locked out of your own files by malware for even just a day will impact your revenue. But given that ransomware takes most victims offline for at least a week, or sometimes months, the losses can be significant. Systems can remain offline for so long, not simply because ransomware locks the system, but because of all the time and effort required to clean up and restore networks.

And it isn’t just the immediate financial hit of ransomware that will damage a business; consumers become wary of giving their data to companies they believe to be insecure.

Also: Ransomware and phishing attacks continue to plague these businesses

Cybercriminals have learned that not only just businesses make lucrative targets for ransomware attacks, but important infrastructures like hospitals and industrial facilities are being disrupted by ransomware. And such disruptions can have big consequences for people. 

The education sector also has become an increasingly popular target for ransomware campaigns. Schools and universities became reliant on remote learning due to the coronavirus pandemic — and cybercriminals noticed. These education networks are used by potentially thousands of people, many using their personal devices, and all it might take for a malicious hacker to gain access to the network is one successful phishing email or cracking the password of one account.

Small and medium-sized businesses are a popular target because they tend to have poorer cybersecurity than large organizations. Despite that, many SMBs falsely believe they’re too small to be targeted -but even a modest ransom of a few hundred dollars is still highly profitable for cybercriminals.

Smaller businesses, and low-hanging fruit, can also make tempting targets because supply chain attacks can provide access to a larger, more lucrative target. 

The rise of cryptocurrencies like Bitcoin has made it easy for cybercriminals to receive payments with less risk of the authorities being able to identify and trace the perpetrators.

Digital wallets are used to store cryptocurrency and — while not untraceable — this makes it more difficult to track and seize illegal funds — especially if the crypto funds are mixed and filtered out through multiple wallets and cryptocurrency exchanges. 

Because large numbers of ransomware attacks start with hackers exploiting insecure internet-facing ports and remote desktop protocols, one of the key things an organization can do to prevent itself from falling victim is to ensure that ports aren’t exposed to the internet when they don’t need to be.

When remote ports are necessary, organizations should ensure that login credentials are complex. Applying multi-factor authentication to these accounts also can act as a barrier to attacks, as there will be an alert if any attempt is made at unauthorized access.

Networks should be patched with the latest security updates because many forms of ransomware – and other malware – are spread via the use of common, known vulnerabilities.

When it comes to stopping attacks via email, managers should provide employees with training on how to spot suspicious emails. Employees noticing unusual details – say, an email with sloppy formatting, or a message purporting to be from ‘Microsoft Security’ sent from an obscure address that doesn’t even contain the word Microsoft – might save networks from infection. 

Also: 6 simple cybersecurity rules you can apply now

There’s also something to be said for enabling employees to learn from making mistakes while within a safe environment and through phishing training exercises. 

On a technical level, stopping employees from being able to enable macros is a big step toward ensuring that they can’t unwittingly run a ransomware file. Endpoint protection, alongside firewalls and behavioral anomaly detection solutions, also can help.

At the very least, employers should invest in antivirus software and keep it up to date, so that it can warn users about potentially malicious files. Backing up important files and making sure those files can’t be compromised during an attack is also key because that makes it possible to recover the network without paying a ransom.

But even if attacks are already inside the network, it isn’t too late – if information security teams can spot unusual or suspicious activity before the ransomware attack is launched, it’s possible to reduce the scope of the attack or prevent it altogether.