Three things you can do to protect your workforce against ransomware attacks

Take charge of your data

“We’ve got your data. If you ever want to see it again, send us $1000 or forever lose your files.”

Now while that might not seem like an everyday conversation, holding your data for ransom, aptly coined ransomware, has lately become widespread globally. One of the latest attacks to make headlines worldwide was the PetrWrap attack, initially believed to be a strain of the Petya virus making its way from Ukraine through Europe into the US.

Sounds scary? Let’s take a closer look.

Traditional ransomware attacks usually end up encrypting the files on a local disk and ask to pay a ransom amount to decrypt them using an encryption key held by the creators of the virus. Sky News reports that what makes the PetrWrap attack different is that it simply makes the entire disk unreadable and forces you to reboot your machine. Once rebooted, you see the ransom note that only allows you access to your entire machine if the ransom demand is met.

Lead Data scientist at McAfee, Christian Beek, tells Wired.com that the attack uses a fake authentication certificate usually used as an internal tool by Microsoft. This suggests that the attack is not disguised sophisticatedly and therefore it is relatively easy to read the functionality of this particular style of attack.

While it may seem like the battle against new and sophisticated attacks is never-ending, and while that is true, there are behavioural changes you can make within your workforce that can help you stay ahead and be wary of such attacks.

Here are three things you can do to prepare your staff in identifying a ransomware attack and generally being more cyber-aware.

Think before you click

Even if you manage to maintain all the latest patches for your systems, malicious actors always find new zero-day vulnerabilities to exploit. Usually these attacks are initiated by targeting users, sending email messages with attachments and the exploit begins when the files are downloaded or opened. The biggest precaution users should take is to be careful about which files and emails they open.

Test your organization’s vulnerability

Even with the most advanced perimeter network protections, malicious actors use creative ways to reach users undetected. Phishing simulations are a fast and efficient way to measure employee vulnerability while ramping up awareness of the seriousness of the risk. Send simulations completely adapted to the various risks present in your company and show your global staff how to eliminate risk and be your organization’s strongest line of defense.

Get with the program

How would you know if one of your users paid the ransom to avoid repercussions or embarrassment for falling victim? An effective program that presents the principles of Information Security Awareness Training, allows users to understand and apply best practices to security matters and know how to proceed if they are ever infected. It emphasizes the importance of protecting confidential and strategic information.  By acquainting your users with the threats and teaching them how to avoid them, the program will help minimize your organization’s operational risks and financial losses. Protect employees’ devices and company’s data from ransomware, malware, phishing and other cyber-attacks. Train your workforce with the kind of behavioral learning and reinforcement that builds a culture of security.

Key Takeaway

Staying ahead of new cyberattacks is tough with the variety of attacks emerging each day. However, educating your staff on how to protect information against these attacks is not a matter of a one-time-fix; daily habits and cyber security awareness is what defends you best in the longer run. Make sure employees stay vigilant online, their machine just might be next.