What is ransomware, and how should a small business prepare for it?
Ransomware is malicious software that locks a business's files and demands payment to unlock them. To prepare, keep backups that are not connected to your network and test them, keep software updated, train staff to spot phishing, and write a plan with the phone numbers you would need. If it happens, the FTC says to disconnect infected devices without powering them down, then call for help. The FTC notes that law enforcement does not recommend paying, but leaves the choice to the business.
What ransomware is
CISA describes ransomware as a form of malware designed to encrypt files on a device, making those files and the systems that rely on them unusable. The attackers then demand ransom in exchange for decryption. For a small business, that can mean being unable to reach files, bookings or customer records.
How it usually gets in
The FTC says most ransomware attacks start with phishing or scam emails with links and attachments. It also lists other routes:
- Weaknesses in servers that criminals can exploit to reach your network.
- Infected websites that can download malicious software automatically.
- Online ads with malicious code, even on sites you know and trust.
- Remote access tools, such as remote desktop, that can let criminals reach computers.
How to prepare
- Back up beyond the network. The FTC advises saving important files and a full backup (files, programs and operating system) to a drive or server not connected to your network. CISA advises offline, encrypted backups and regularly testing them. The related answer on backing up business data has the checklist.
- Keep software updated. The FTC advises installing the latest patches and updates and, if you can, setting everything to update automatically. The related answer on keeping computers and phones updated covers the routine.
- Train staff. The FTC advises teaching staff to avoid phishing and including ransomware tips in regular orientation and training. The related answer on spotting a phishing email covers the signs.
- Write a plan. The FTC advises having a plan to keep the business running after an attack and sharing it with everyone who needs it. As general advice, include who to call (your IT help, bank and insurer, if you have them), where the backups are and who makes decisions.
If it happens
- Disconnect infected devices from your network without powering them down, because the FTC says information useful for investigation may be lost if you power them down.
- Bring in experienced IT or cybersecurity staff, or a third-party cybersecurity company, to investigate (the FTC).
- Report it. The FTC says to report to your local FBI office and appropriate industry regulators. CISA says victims should report to federal law enforcement through IC3 or a Secret Service Field Office, and can ask CISA for technical help.
- If your backups are stored off your network, the FTC says you can restore files from them.
- If personal data was compromised, the FTC says to notify the affected parties. The related answer on what to do after a data breach covers that.
On paying
The FTC says law enforcement does not recommend paying ransom, but that deciding whether the risks and costs are worth the possibility of getting your files back, or of having sensitive information exposed, is up to the business. It also notes that paying does not ensure your data comes back. No preparation removes the risk entirely, but tested backups and a plan can make the choice less forced.
Sources
Related answers
- How should a small business back up its data?
- How do you keep business computers and phones updated, and when should you replace them?
- How do you spot a phishing email or text, and what should staff do with it?
- What should a small business do after a data breach?
Ongoing technical support
The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.