The new threat to business uptime

Ransomware attacks are growing more frequent thanks in part to two technology trends: the increasing processing powers of computers (which are now so powerful that they can encrypt their own files in a matter of hours) and the rise of anonymous payment systems such as Bitcoin (which make it easy for criminals to accept payment without fear of being traced).

Numerous tech publications have listed ransomware among the biggest digital threats facing businesses today. This is due to its capacity to slip through corporate security and its potential to replicate itself across a corporate network. Even Apple users aren’t immune: the first ransomware targeting Macs has recently been spotted. More is sure to come.

“Cryptowall”—the cause of Luke’s all-nighter—is one of the more well-known families of crypto-ransomware, a category of viruses that encrypts files on a victim’s computer and keeps them locked until the victim pays a set ransom. If you don’t pay the criminals who spread the virus—up to $5,000 per user, according to the FBI—you’ll lose the files forever.

In other words: imagine you arrive at your office one day to find all your computers padlocked, and a man in a mask demanding $5,000 per user to give you the key. That’s what ransomware is like.

The next great threat to business IT?

Ransomware attacks are growing more frequent thanks in part to two technology trends: the increasing processing powers of computers (which are now so powerful that they can encrypt their own files in a matter of hours) and the rise of anonymous payment systems such as Bitcoin (which make it easy for criminals to accept payment without fear of being traced).

Numerous tech publications have listed ransomware among the biggest digital threats facing businesses today. This is due to its capacity to slip through corporate security and its potential to replicate itself across a corporate network. Even Apple users aren’t immune: the first ransomware targeting Macs has recently been spotted. More is sure to come.

If your company gets infected, you face two very hard choices: either spend multiple days recovering the locked files from backups—during which time you’ll endure user downtime, lost sales and angry customers—or pay ransom to an organized crime syndicate.

(Even then, you still need to wipe and restore your computers to remove the virus. Without a business continuity plan in place, infected users will experience downtime regardless. More on that below.)

      Just ask the Hollywood Presbyterian Medical Center

The employees of the Hollywood Presbyterian Medical Center can tell you what it’s like. This February, they were forced to take their PCs offline so I.T. could contain a ransomware outbreak and restore their files. They spent 10 days relying on fax machines and paper charts. They made unwanted headlines in the New York Times, the BBC and countless other publications. In the end, they ended up paying $17,000 in ransom, just to avoid even more protracted downtime.

This report helps you understand the true cost of ransomware, learn some basic prevention and containment techniques, and plan for business continuity to avoid downtime in the increasingly likely event that your business will get hit.

The scope of the threat

Intermedia commissioned an independent research firm to conduct a survey of nearly 300 IT experts about the crypto-ransomware threat. The survey respondent panel was carefully screened to include experts that consult with businesses of all sizes on setting up and maintaining IT infrastructures. These are the men and women who are on the front line of business IT challenges such as ransomware.

The full results of the survey are available in Intermedia’s 2016 Crypto-Ransomware Study. This report will focus on three key findings: 1) The biggest cost to businesses is downtime, not the ransom payment; 2) Ransomware is targeting bigger businesses and spreading within corporate networks; and 3) A widespread lack of business continuity planning is what makes ransomware so dangerous (and so lucrative for criminals).

Paying ransom is the least of your worries

When asked to name the business impact of ransomware outbreaks that these consultants have assisted with first-hand, they listed the actual cost of the ransom last. In other words, contrary to popular belief, the actual ransom payment is far from the worst damage caused by ransomware.

Downtime lasts for days

A computer that is discovered to have ransomware must immediately be isolated from the corporate network in the event the malware is programmed to spread. This leaves users without access to their computer while IT contains the virus and restores the device. But even if they can get to their files through alternate devices, the files themselves are encrypted and thus unusable.

There are business continuity solutions for ransomware (more on that below), but the survey results suggest that few businesses have any solution in place: 72% of business users lost access to data for at least two days, and 32% lost access for five days or more.

Preventing ransomware

Like most forms of malware, ransomware infections may arrive through malicious web pages, infected thumb drives, or other common attack vectors. But the most common infection vectors are email-based—often using the same techniques found in phishing emails.

“Phishing” is when criminals send a seemingly legitimate email that disguises a malware-laden attachment or link to an infected website. Criminals often use phishing to trick users into submitting sensitive information such as passwords or credit cards; but these days, they’re also using it to spread ransomware.

In a recent study¹, 94% of people couldn’t tell the difference between a real email and a phishing email 100% of the time. When study participants received an email that was spoofed to appear as if it was sent by UPS, 62% trusted it enough to click the link.

Protection against ransomware goes hand-in-hand with phishing prevention. Here are your top three activities:

Business continuity during a crypto-ransomware outbreak

“Business continuity” is the ability for the business to continue operations even while a disaster is ongoing.

Many businesses have plans in place for natural disasters, power outages or other disruptions. Fewer have “e-crisis” response plans for cyber threats such as ransomware. That’s one of the reasons ransomware has been so disruptive to businesses and so profitable for criminals: business continuity solutions have not previously existed.

In order for users to continue working during a ransomware outbreak, two capabilities are required.

Some of these capabilities exist in file sync and share products. Other capabilities exist in backup products. Ransomware has been so lucrative for criminals because these two capabilities have never before been present in a single product.

File Sync & Share’s Weakness: You can’t easily roll back to clean files.

When ransomware encrypts the files in your online storage folder (Dropbox^®, Box^®, Google Drive^®, etc.), the encrypted files sync up to the cloud. So online versions are also locked. While you can perform rollback on a file-by-file basis, you can’t instantly perform a ‘mass rollback’ to revert your entire file archive to uninfected versions. Some providers offer this service through a support request, but the process takes hours or days.

Backup’s Weakness: You can’tinstantly access clean files.

Restoring from on-premises backup takes hours. Restoring from cloud backup takes even longer. For example, Carbonite’s^® restore rate is 10 Mbps, which means a 50 GB file archive will take around 12 hours to restore.¹ In all cases, the user is completely idled while the backup is restoring.

If any user in your business gets hit with ransomware, you should instantly close the computer and isolate it from your network. You should absolutely wipe the computer and restore from backup. These are the best practices that will prevent the infection from spreading.

However, if you have SecuriSync in place, your users won’t be idled during this process. Here’s how it works.

With this kind of business continuity plan in place for ransomware, the benefits are clear:

• For users: Ransomware becomes a mild disruption instead of a major disaster
• For IT: User productivity is restored immediately, so you can carefully focus on containing the outbreak and preventing future infections
• For The Business: Avoid lost sales, angry customers and bad PR • Plus, no need to pay ransom