• Despite its rise to become a top threat to businesses in 2016, one out of 3 SMBs until recently, had no idea what ransomware is.
• There is a ransomware attack somewhere in the world roughly every 40 seconds
• Roughly 32% or so of those attacked end up paying the ransom. Even so, around 20% of those who pay still don’t end up getting back their data!
• Healthcare and Manufacturing companies generally seem to be the hot targets primarily due to their reliance on legacy systems combined with weak security – although nobody is really immune.

The attackers in these cases are always faceless and nameless – there is no opportunity to reason or negotiate with them.  The rise of bitcoin for transactions has also aided ransomware attackers by increasing their ability to remain anonymous.

Ransomware attacks can potentially be more damaging than classic breaches which result in stolen bank accounts or credit card information.  Many such losses are recoverable soon after the breach has been discovered, but lost business plans and product designs which are a company’s crown jewels can be irreplaceable.

While ransomware can attack any type of computer, in most cases, the infected computer is an end user’s laptop or workstation.  Therefore, any data stored on local disks, file shares, and mapped network drives are vulnerable.  Most popular cloud storage solutions also become vulnerable due to the replicative nature of their work.  Since ransomware deletes the original files and replaces them with their encrypted versions, most cloud storage solutions faithfully replicate these changes in their repositories as well.  While some of these solutions have file versioning capabilities, they don’t usually have an option to perform a bulk restore of large amounts of data.

Sadly, existing anti-malware solutions cannot be relied upon to detect and stop all ransomware.  The rapid and quick-moving malware underground ensures that anti-malware vendors are always playing catch-up.

Educating users on how to identify possible payloads and avoid them, would seem to be the best approach against ransomware – after all, prevention is better than a cure.  While this can be effective, the reality is that the ransomware authors have to bypass a defense just once to do their dirty deed, and they constantly change tactics in order to do so.   Even the best prepared amongst us can get outwitted at some point or another.

Much of the writing that has been done around WannaCry has mostly focused on the Microsoft vulnerability and the importance of keeping systems updated.  While this is certainly important, it cannot be a 100% defense against new wannacry ransomware variants that take advantage of zero-day vulnerabilities that are yet, unprotected.

So, what can one do beyond keeping up to date with the latest OS updates and security patches?  Experience tells us that the best defense against wannacry ransomware is a data backup.  A clean backup of an organization’s data can prevent them from being held hostage by an attacker, even if their other ransomware defenses fail.