Ransomware – Kidnapping in the digital age

Ransomware is nothing more than extortion software. A Trojan finds its way into a PC or enterprise network, becomes active and starts its „work“. All data – including sensitive business and customer information – on hard drives or servers is copied and encrypted, blocking access to it. Nothing works anymore. Only a message appears on the screen: The computer has been “hijacked” and will only be released after ransom has been paid, which usually has to be done by a specific deadline. Payment is to be made via bitcoins or in another digital currency that cannot be traced back to the recipient. And “no police!”

Immense damage

Granted – I don’t know whether “no police” is part of the ploy. But it is doesn’t really matter. The fact that one’s own data ends up in the hands of criminals shows just how dangerous such an attack is. There is always a risk that files and documents will be published unprotected and freely accessible on the Internet – even if the victim agrees to the attackers’ demands and pays. Attackers are usually based abroad and operate via encrypted networks. There is little chance of tracing an attack back to the cybercriminals. The situation is serious. Ransomware attacks on enterprises are on the rise and the damage caused by them is immense. During an attack on the Düsseldorf University Hospital in September 2020 one person even tragically died. Just recently it turned out that, according to the German Federal Office for Information Security (BSI), the attack could have been prevented. Basic protection would have been enough. Even worse: The BSI warned Düsseldorf University Hospital as early as January 2020 – eight months before the attack.

Safeguarding your business in five steps

Effective protection can be achieved if businesses implement a five-phase plan as part of their cybersecurity strategy. The experts at TÜV Rheinland refer to the following steps: Identify, protect, detect, respond and recover.
In the first phase, a risk analysis is carried out, followed by appropriate measures to clearly identify possible risks. This includes examining the processes and the value of all information held within a company. It might be useful to support this examination by performing penetration tests to uncover vulnerabilities in the corporate network. The next step is to implement appropriate measures for protection, for example, filtering out spam e-mails or securing individual computers – the so-called endpoints. The “endpoint response“ is used to detect and fend off an impending virus or to initiate an “incident response process“. Finally, the recover phase is about backup solutions with suitable recovery plans for emergencies.

Professional advice is useful

A key aspect of this approach is the preparation of an emergency plan that includes clear rules for crisis communication. If an attack takes place, it is crucial to inform all stakeholders, such as government authorities or business partners, promptly and appropriately.

Anyone can be affected

No business is too small or too insignificant to be attacked. It really can hit any company. But not just businesses and organizations, private individuals can also be the target of an attack. If you do not ensure a sufficient level of protection on your home laptop or desktop PC, you can expect a Trojan to find its way into your computer, opening the gate for the ransomware attack and locking the device. While ransom demands certainly won’t be as high as for companies, it is at least a major nuisance – especially when the photos of the family celebration suddenly appear on the Internet. Therefore, please always install all Windows updates, keep your antivirus and firewall software up to date and always use the most recent versions of your browsers. If offered by the antivirus manufacturer, install a plug-in for the browser that monitors the Internet sites visited. Plus, you really should always secure your own Wi-Fi with the highest possible level of encryption – and use a really inconvenient password to do so.