Why you should think twice before paying a ransomware demand

Cyber criminals operate outside of the law. There is no guarantee that if you pay the ransom, you will actually receive the promised decryption tool. Moreover, there is no guarantee that the decryptor tool will work. According to a report by the CyberEdge Group, 38.9% of businesses affected by ransomware paid the ransom but lost their data.

In addition, if you choose to pay the ransom, you may be targeted again in future as criminals know you are willing to pay.

Finally, there are ethical questions to consider. Paying the ransom may incentives more attacks as criminals know it is lucrative. You may therefore be perpetuating the ransomware cycle. It is suggested that paying demands has made ransomware so lucrative, it has led to ‘Ransomware as a Service’. This is where hackers have packaged turnkey ransomware kits, allowing criminals with little (or no) technical experience to easily launch their own ransomware attacks.

Preventing ransomware attacks through good practice

Protecting your systems by adopting a range of security measures is key. Equally important is having up-to-date backups, separate from your network, so your data can be easily retrieved and not held ransom.

We summarise our good practice recommendations below:

• Regular backups: Ensure your backups are up-to-date and secure to protect against ransomware and hardware failure.
• Patch management: Install patch updates as quickly as possible to reduce the risk of cyber criminals exploiting identified vulnerabilities.
• Malware protection: Adopt a multi-layered approach to your IT security. This includes antivirus software, firewalls and advanced email protection.
• User education: Human error is one of the biggest threats. Increase employee training so they are aware to not click on suspicious links and only download software from trusted websites.
• Control removable media: Disable the use of USB storage devices to prevent ransomware being brought in inadvertently.
• Visit the No More Ransom site: This is an online portal that helps ransomware victims retrieve their encrypted data without paying criminals. You need to upload two encrypted files which are cross referenced against a list of available decryption tools. If there is a positive match, you can unlock your files for free. It is not fool proof however and a suitable decryption tool may not be available.