As many of you may have heard, businesses throughout the world have seen an increase in ransomware being used against them. What should businesses do to help prevent these sort of extortions from happening to them? This is what we will attempt to answer with this posting.

We have all heard the old adage “an ounce of prevention is worth a pound of cure”, nothing could be truer, especially for this particular situation! So lets go over some of the preventative steps that your organization may follow before you become infected with ransomware:

• User education and training! Start off with end-user education, you know the people who are actually going to see these sort of attacks. Lets not focus on just select few like your sys-admins, but rather the entire organization. Everyone has a part in keeping your business secure and education is the key.

• As part of the education of the end-users, let them know who to contact if they see something suspicious, whether that is your help desk or someone who is designated for your organization to help guide them through the process of what to do. The end-users have to be able recognize that something has occurred in order for them to report it in the first place.

• Organizations should enforce the least privileged methodology. This is a way to grant the minimum amount of access to files as the person needs to perform their job-related duties. If a person does not need read/write access to certain files don’t grant it. This will help keep the ransomware from doing the same since they work based on the privileges of the person who is logged in at the time and encrypt files that the person has read/ write access to.

• Most organizations now configure their email servers to prohibit them from sending or receiving executable files. Make sure yours does too. The real issue here are macros that are enabled when sent with a document. As this is a potential attack vector for this and other types of malware.

• Patch your software to the most current version. By not doing so you may be leaving the door open for a variety of malware to take advantage of your company. The malware will exploit flaws in the older versions of software that your company uses. We have seen time and time again where businesses aren’t aggressively keeping their software updated to the latest version and they are targeted by threat actors as a result.

• If possible restrict the execution of programs from temp folders in a user’s profile. For example, “c:\users\<username>\folder\temp”. What do I mean by this? If a virus or ransomware in this case, were to attempt to use a temp folder as the first execution point it would be blocked from being allowed to do so by Group Policy Objects. So you effectively nix the ransomware before it has had a chance to infect your computer!

• Organizations should consider implementing some sort of web filtering such as keeping track of blacklisted IP addresses or domains.

• Whatever antivirus solution your company employs please ensure that they are updated with the latest virus definitions to increase their effectiveness. A company could even consider having different antivirus products for different purposes, such as having one product for desktops and another for email. That way the company is ensuring that there is some degree of overlap in their antivirus coverage!

• Adobe’s Flash should be disabled at this point, as it really has been a very popular infection vector for ransomware. Disabling it would greatly reduce the amount of infection vectors available to would-be attackers.

• Lastly, backups are really the only way to restore functionality to the affected systems once they have been compromised, providing a backup process already exists in your organization and that the backups are checked for completeness. This way if you do need to use your backups, they will get you back on your feet as soon as possible with the least amount of downtime.

As always the education of all of your employees is key to this or any other sort of security related incident before it happens. As is effective communication both before a security incident starts and during the response/ recovery process.