3 Ransomware Myths Businesses Need to Stop Believing ASAP

Despite the rising ransomware numbers and the numerous related headlines, many small and medium-sized businesses (SMBs) still don’t consider themselves at risk from cyberattacks. Nothing could be further from the truth. Smaller organizations are a prime target, and ransomware authors have only upped the ante in their methods to ensure they get paid. For example, many ransomware groups now threaten to expose or sell company data stolen in a breach if victims refuse to pay. In many cases, paying the ransom may be the most cost effective (and least publicly embarrassing) option. But what if your business can’t afford it? Or if the downtime from the attack is too much to recover from? And what’s the long-term psychological and emotional toll?

Here are 3 myths about ransomware that businesses need to stop believing to stay resilient against these evolving and insidious attacks.

Myth #1: My Company is small, so attackers won’t bother.

Today, any business is a target for ransomware, no matter its size. Since 2018, up to 86% of SMBs have reported being victims of ransomware each year. And, according to Verizon, “[Ransomware] is a big problem that is getting bigger, and the data indicates a lack of protection from this type of malware in organizations.”

We’ve put this myth at the top of our list because it’s particularly dangerous. For many small organizations, a single cyberattack could put them out of business. Bigger enterprises with more robust data recovery and bigger security budgets are much more likely to weather an attack, while a smaller business may have no way of making up for the loss of time, revenue, and damage to customer trust that an attack could have.

Ransomware is not going away, and it’s getting more costly for SMBs. Businesses can’t afford to underestimate the risk.

Myth #2: There’s no way to prepare for a ransomware attack.

The sad truth in today’s cyber climate is that an attack is practically inevitable. The trick is reducing the likelihood of an attack, and making sure critical data is protected in case an attack succeeds. To prepare your business to weather the storm, there are a few key steps you can take.

•Proactively defend against ransomware attacks.
Ransomware typically gets into an organization by tricking a user into downloading a file and/or enabling macros. Combining reliable endpoint protection that can stop macros and malicious scripts with security awareness training for end users is an excellent step toward a proactive and in-depth defense.

•Protect your data.
The ransomware business model works because losing access to your data can cause serious damage. A strong backup solution is vital.

•Ransomware Readiness Report
While the methods hackers use to successfully infiltrate the network are constantly evolving, once they are inside the network…their actions are very similar. How exposed is your organization? Ask ICS to prepare a ‘readiness report’ and discuss the results with you.

Myth #3: I already have a backup, so I’m safe.

If your business gets hit with an attack, you can and should expect some downtime. And if we accept the maxim “time is money,” then any amount of downtime is costly and potentially damaging. Having backups in place is crucial, but you also need to be able to recover the data you need quickly from safe backups that haven’t also been infected with the ransomware.

Bigger organizations have more resources to invest in redundant servers in multiple locations, but these protections can come at too high a cost for many SMBs. If that sounds like you, you’re not alone. We recommend you look into ICS disaster recovery services, so you can leverage the cloud to ensure that critical business systems are online and accessible, no matter what happens on your network.

Next Steps

It’s said that hope is not a strategy. Rather than hoping your business isn’t hit with a ransomware attack, or hoping your backups will remain uninfected, or hoping your cloud-based data will be protected, a better approach is to plan and prepare to prevent ransomware and other cyber-attacks. When you take action to better protect your data and plan for recovery in the event of a successful attack, you are one step closer to achieving cyber resiliency. One of the best actions you can take to drastically improve your chances of avoiding a ransomware attack entirely, is to enroll with ICS Managed Detection and Response platform utilizing the capabilities of our 24/7 Security Operations Center. Contact us for more information.