Ransomware: A Concern for Small Businesses

Small business are actually more vulnerable to ransomware attacks and are potentially a more viable target for this type of attack.

You may be asking why I say this. There are several reasons that lead me to this conclusion. Let me provide a brief explanation of each of the points that should be considered.

  1. Lack of dedicated IT and Security Staff – without having staff dedicated to this effort, you are leaving yourself open, and the criminals know this! The primary responsibility for staff members such as these are to ensure the security of the perimeter of your environment, monitor and manage security tools that will detect these types of attacks and have processes in place to recover if (when) an attack occurs.
  2. Uneducated users – I’m not talking about someone that lacks an education, I’m referring to the number one defense against these types of attacks, and that is education. Understanding how an attack occurs, and the types of social engineering that these people use to entice an unsuspecting user to open a file that contains an attack.
  3. Lack of current security tools – This goes with the first point. Having a good security infrastructure in place is more than anti-virus or anti-malware software, a Comcast or Verizon firewall, or even a Windows Firewall on your computer. (See my blog about the truth about firewalls for more information.) A good security infrastructure includes these components but also includes things like vulnerability assessment, patch management, and deploying (and following) security best practices and procedures.
  4. Lack of backups – I’ve blogged on this topic a number of times. I am a backup fanatic. I have backups of my backups of my backups. There is no better way to recover from an attack than by having a good backup solution in place. And backups are not just moving data to another device to free up space. A backup means that you have the same data in multiple locations, preferably NOT on the same network. And this goes for home users as well as business environments.
  5. No disaster recovery plan – I know. Disaster Recovery is a big term used a lot by big business to claim that they can recover their environment in a short period of time. Wikipedia defines a disaster recovery plan as a documented process or set of procedures to recover and protect a business IT infrastructure in the event of a disaster. Well, most people think of a disaster as their building burning to the ground, a flood in the room next to your server, or theft of your hardware. Attacks like ransomware are just as disastrous, if not more. In the case of a flood or fire, you actually have a chance of recovering your data. In the case of ransomware, there is little to no chance of recovery other than paying the ransom (which is the worst thing you can do.) Remember, you’re dealing with criminals in a case like this, and trusting them to provide a key to decrypt your data if you give them money only makes you out to be a target for future attacks, and does nothing to ensure that you will ever receive a decryption key.

I’ve covered some of these topics in previous blogs, and will cover more of them in more detail in blogs to come. And, small business owners are not, and cannot be expected to be subject matter experts at this level of detail about security and the impact of poor practices.

If you have any doubt about how vulnerable you may be, you need to contact a reputable company that can come in and analyze your entire IT infrastructure, including security processes and procedures, and provide you with the results that will give you a realistic risk analysis.

For today, I leave you with these questions.

  1. How long can you afford to go without your critical business data before you start losing money and become unable to provide your customers with the services you provide?
  2. How much money do you stand to lose for each employee that is non-productive until your data is recovered?I

f you are honest with yourself when answering these questions, you will be stunned at the numbers you come up with. There are many studies that show just how devastating it is to be without your data and production environment.

If (when) you need help understanding your risk profile, Carney Technology Group can help. Give us a call at 484.228-8284 to schedule a free risk analysis of your environment so you can be prepared when disaster strikes.