Top tips is a weekly column where we highlight what’s trending in the tech world today and list out ways to explore these trends. This week we’re looking into how your organization can recover from a ransomware attack.
It’s well known at this point that ransomware attacks are an inevitability. With around 493.33 million ransomware attempts in 2022 alone, it’s not a question of if you’ll fall victim to a ransomware attack, but rather it’s a question of when. Considering the reality of the situation, it’s clear that merely setting up defense mechanisms won’t cut it, as even these don’t guarantee that you’re 100% safe. It’s equally important to have effective data recovery plans in place to help you bounce back from an attack.
Here are four tips that can help you bounce back quickly from a ransomware attack.
1. Do not pay the ransom
This is the first thing to keep in mind. Remember, you’re dealing with criminals and there’s no guarantee that you will receive the decryption key even if you pay the ransom. That being said, if you don’t have any up-to-date backups of your data, paying the ransom may be your only option. You may also find yourself in the unfortunate position of being forced to pay the ransom due to what’s at stake.
Weigh your options: Do you just accept the data loss and move on, or is it critical enough to warrant paying the ransom, however much it may be? Just remember, when you pay the ransom, you’re encouraging the attackers to continue carrying out similar attacks, since you’re essentially proving their modus operandi works. Additionally, you’ll incur several other costs to clean up and remove all traces of the malware from your systems, as the decryption key will likely not remove the ransomware itself.
2. Start from scratch (purge and restore)
Backups are generally the most reliable method of data recovery, and if you’ve been backing up all your data regularly, you’ll find that recovering what’s been lost to a ransomware attack is relatively simple and cost-effective. The more recent the backup, the better.
Having recent backups of your data allows you to wipe your systems clean and start from scratch. Of course, while it does sound simple and straightforward in theory, it is going to be a time-consuming process. However, according to Sophos’ State of Ransomware 2023 survey, it is still quicker than paying the ransom and helps you ensure that you remove all traces of the malware from your affected devices. You also won’t have to waste time and resources communicating with the attackers or attempting to delete the malware and decrypt your data.
3. Implement incident response automation (IRA)
IRA is the use of AI or other machine learning models to constantly monitor and automatically detect security anomalies in your network that can be mitigated using predefined inputs or escalated for human intervention.
An effective IRA tool can inform you about vulnerabilities that are undetected by your IT teams. These tools are also able notify you of any anomalous behavior in a particular device or part of the network, enabling you to take swift action before it snowballs out of control. An effective IRA mechanism could mean the difference between isolating and stifling the spread of the ransomware and getting all your data encrypted.
4. Make sure to keep all stakeholders in the loop
The damage caused by a ransomware attack isn’t always of a financial nature; these attacks can also deal a significant blow to the victim organization’s reputation. Keeping stakeholders in the loop from the moment of detection can help you manage the narrative and your reputation during and in the aftermath of the attack. Constant updates can help you show stakeholders that you are aware of the attack and are doing everything necessary to mitigate it. Transparency is key.
Ransomware attacks may sometimes even compromise your communication channels. In such a case, you can use secure group messaging platforms for internal communication and use third-party marketing platforms to reach your external stakeholders. Furthermore, you may also be required by law to communicate cybersecurity incidents to your stakeholders within a certain timeframe.
Once the data has been recovered, it’s always a good idea to perform a root cause analysis (RCA) to determine how exactly the attack took place to show them that you have detected the point of entry and have or are in the process of fixing any vulnerabilities that served as entry points into your network.
Just like a disaster recovery plan for security incidents, it’s also important to prepare a stakeholder communication plan in which you identify key stakeholders, the information you need to share, and a timeline to share it to ensure there are no delays in communication.
An effective recovery plan is key to bouncing back from a ransomware attack
It is important to note that, as helpful as these tips may be, it doesn’t mean you’re going to come away unscathed; expect some (or even a lot of) damage. The whole point of ransomware is to halt your operations and it is incredibly effective at this.
One thing is for certain, however, and it’s that having a comprehensive and effective recovery plan in place can save you a lot of trouble if you do suffer an attack, helping you bounce back with minimal impact. Cybersecurity is an ongoing process, and the learnings you take from a ransomware attack can aid you in bolstering your security infrastructure.
