5 key questions about ransomware for small business owners to answer

This article explains the basics of ransomware, and suggests relevant questions that small business owners and directors might want to ask their IT experts to help drive greater cyber resilience against these types of attack.

Why should small business owners concern themselves with ransomware?

Cyber security is a board level responsibility, and your senior management team should be specifically asking about ransomware as these attacks are becoming both more frequent and more sophisticated.

Ransomware attacks can be massively disruptive to organisations, with victims requiring a significant amount of recovery time to re-enable critical services. These events can also be high profile in nature, with wide public and media interest.

What do small business owners need to know about ransomware?

Small business owners don’t need to be able to distinguish between one type of attack and another, but knowing the basics of how ransomware works will mean they can have constructive conversations with both internal and external IT on the subject.

So what do you need to know about ransomware?

Ransomware is a type of malware that prevents you from accessing your computer (or the data stored on it). Typically, the data is encrypted (so that you can’t use it), but it may also be stolen, or released online.

Most ransomware the NCSC (National Cyber Security Council) see now is ‘enterprise-wide’. This means it’s not just one user or one machine that is affected but often the whole network. Once they’ve accessed your systems, attackers typically take some time moving around, working out where critical data is saved and how backups are made and stored. Armed with this knowledge the attacker can encrypt the entire network at the most critical moment.

The attacker will then usually make contact with the victim using an untraceable email address (or an anonymous web page), and demand payment to unlock your computer and/or access your data. Payment is invariably demanded in a cryptocurrency such as Bitcoin and may involve negotiation with the humans behind the ransomware (who have spent time in your organisation’s networks assessing how much you might be willing or able to pay).

However, even if you do pay the ransom, there is no guarantee that you will get access to your computer, or your files.

The NCSC have also seen cyber criminals threaten to release sensitive data stolen from the network during the attack if the ransom is not paid.

The UK government strongly advises against paying ransoms to criminals, including when targeted by ransomware. There are practical reasons for this (see question 4) and also concern that paying ransoms likely encourages cyber criminals to continue such attacks.

So, here are the five key questions about ransomware for small business owners to ask:

Q1. As an organisation and as a member of senior management, how would we know when an incident occurred?

There is often a significant period of time (known as ‘dwell time’) between an attacker gaining access to your systems and the ransomware itself being launched. Identifying unauthorised access to systems early can help stop an attack, so you need to consider:

• Has your senior management team explicitly conveyed the threshold for when it wants to be informed of an incident?
• What monitoring is in place around those critical assets (like personal data) that would have an impact if compromised, lost or changed? Bear in mind that an attacker may have gained access through non-critical systems, so regular monitoring across assets is important.
• Who examines the logs and are they sufficiently trained to identify anomalous activity?
• What mechanisms are there in place for staff to report any suspicious activity?
• Are the thresholds for alerts set to the right level (that is, are they low enough to give suitable warning of potential incidents, but also high enough so that the team dealing with them are not overloaded with irrelevant information) ?
• How confident are you that you know all the IT assets that your organisation has, and what the state of those assets are? Many attacks can come in via equipment that organisations are unaware of.

Q2. As an organisation, what measures do we take to minimise the damage an attacker could do inside our network?

Ransomware attacks cause damage and can spread rapidly within your systems. You therefore might like to ask:

• How does the organisation authenticate and grant access to users or systems? Are these measures hard to bypass, and is access only afforded if necessary?
• How would the organisation identify an attacker’s presence on the network, (e.g. is monitoring in place)?
• How is the network separated so that if an attacker gets access to one device, they will not have access to the full range of the technical estate?

Q3. As an organisation, do we have a incident management plan for cyber incidents and how do we ensure it is effective?

Organisations should think in terms of ‘when’ rather than ‘if’ they experience by a significant cyber incident. So it’s essential to plan your response carefully and to practice (or ‘exercise’) your response.

A basic incident management plan should include:

• Identifying the key contacts (e.g. incident response team or provider, senior management, legal, PR, and HR contacts, insurance providers).
• Clear escalation routes (for example to senior management) and defined processes for critical decisions.
• Clear allocation of responsibility (specifically whether this is for normal working hours or 24/7).
• At least one conference number which is available for urgent incident calls.
• Guidance on regulatory requirements (such as when incidents need to be reported and when to engage legal support).
• Contingency measures for critical functions.
• A basic flowchart or process describing the full incident lifecycle, that can be accessed even if you do not have access to your computer systems. Likewise you should ensure that most relevant information (e.g. incident management playbooks and resources such as checklists and contact details) are available ‘offline’.

To assess the effectiveness of your plans you should also ask:

• How do we practice for cyber incidents, how often, and how do we learn from these exercises? (For example, the NCSC’s Exercise in A Box is a free tool that offers discussion-based and simulation exercises, including ransomware scenarios).
• What level of expertise could we call on? It’s best to evaluate and start working with a suitable cybersecurity expert before any cyber security incident has taken place as part of your business continuity planning. Don’t wait until you’ve been attacked, it will be a lot harder and potentially more expensive.

Q4. Does our incident management plan meet the particular challenges of ransomware attacks?

There are particular features of ransomware attacks that more general incident management plans may not fully address. It is therefore important to discuss:

• How might we respond to a ransom demand when attackers are threatening to publish sensitive data? Who would make this decision? (As noted above, the UK government strongly advises against paying ransoms. Furthermore, there is no guarantee that doing so will guarantee a successful outcome as it will not protect networks from future attacks or prevent the possibility of future data leaks).
• Are we prepared for a recovery that could take several weeks (with damage to corporate reputation and brand likely to last longer)?

Q5. How is data backed up, and are we confident that backups would remain unaffected by a ransomware infection?

Ransomware frequently targets an organisation’s data backups, as this increases the likelihood of an organisation paying. So it is essential that your senior management seek assurance on how backups are being made, and how secure these are.

You might like to ask:

• What data is deemed as ‘critical’ and how frequently is this backed up?
• Is critical data saved in multiple backup locations?
• How frequently is non-critical data backed up?
• Is the data in cloud backups restorable and recoverable?
• At any given time, are one or more backups offline?

And perhaps the most important question of all:

How confident are you that you would be able to recover from these backups? How frequently is this checked?

What are your next steps?

No business is immune to ransomware and it’s important for all organisations, regardless of their size or industry, to take the necessary precautions to protect themselves from an attack.

By asking the relevant questions and working closely with your IT experts, you can put yourself in a much better position to respond quickly and effectively if your organisation ever falls victim to ransomware.

If you need any specific advice on how best to protect your business, please don’t hesitate to get in touch – we would be happy to help.

–

Thanks to NCSC for parts of the information in this article on questions about ransomware for small business owners - a great source of cybersecurity advice from the Government at ncsc.gov.uk. Crown Copyright, content reproduced under license