(This post originally appeared on The Guardian)
While the coronavirus continues to wreak havoc on small businesses across the US, another virus is quietly creating its own form of disruption – with similar financial effects. This virus has been around for years, but in just the past few months its cases have been rising at a rate almost as alarming as its biological counterpart.
The virus, or malware, is called ransomware and by now most business owners are familiar with the name. But do we really appreciate the havoc it can cause? When just one employee’s device at a company gets infected, the virus can spread fast through the entire network where it can encrypt – or lock up – files and databases. The only way to unlock those files is to then pay the maker a “ransom”, usually in the form of digital currency, and then hope that the maker lives up to his promises to deliver a key to unlock the infected files. Ransomware is a billion-dollar industry and some of the people behind the malware provide toll-free phone numbers to assist their victims in paying.
“Ransomware is rapidly shaping up to be the defining online security issue of our era,” writes Steve Ranger in ZDNet. “It’s a brutally simple idea, executed with increasing sophistication by criminal groups. A huge chunk of our lives is now stored digitally, whether that’s photos, videos, business plans or customer databases. But too many of us, both businesses and consumers, have been lazy about securing these vital assets, creating an opportunity which criminals have exploited.”
In just over the past few weeks, security researchers have identified at least six significant forms of malware that are making their way across networks in this country, including WastedLocker, Phorpiex, ThiefQuest, EvilQuest, Tycoon and AgeLocker. These names sound like awesome video games. But in reality, they’re all potentially devastating to a small business and most act in a similar fashion. They gain access to company’s network through an employee’s inadvertent click on a fake email, compromised web page or merely by a vulnerability in an old operating system.
Once in, the malware either hides in the background collecting private data or simply makes its attack and demands cash. Unfortunately, with so many companies sending their employees home to work in the wake of the pandemic, the problem has been escalating.
For example, researchers at one security firm, Proofpoint, noticed a rise in email “phishing” (or spoof) campaigns with names like Avaddon, Buran, Dargate and Mr Robot, targeted at work-from-home employees across the world. “These attacks have featured many different families of ransomware and have targeted numerous industries in the United States, France, Germany, Greece, and Italy,” the report’s writers warned. “They often use native language lures and messages.” Even the Securities and Exchange Commission issued a formal alert to firms in the broker-dealer business of a ransomware specifically targeted towards them.
Although big companies tend to be targeted by hackers more often, many small businesses are also victims. One small firm in Kentucky this past year paid a $150,000 ransom to an attacker that locked up its network of just eight computers. “Their initial demand was $400,000,” the firm’s chief financial officer said in a Tech Republic interview. “And from what we were told, this group rarely attacks small companies because their initial demands are usually in the $1 million to $10 million range. So, coming after us or for a half of their normal amount that they typically request just adds to the fact of, why us?”
Why indeed?
The answer is simple: small businesses tend to invest less in security and that makes them an easy target. The bad guys are taking notice. According to one new survey of senior executives, 46% of all small businesses have been the targets of a ransomware attack, and of those companies, 73% were forced to pay a ransom. And with all the disruptions caused by the pandemic, many firms have not paid enough attention to securing the remote devices and laptops that their employees are now using from home to access their networks.
To combat this threat, it’s going to cost. It’s critical that small business owners invest more resources in securing their now far-flung operations. Information technology consultants should be hired to provide training to employees, install security software and monitor networks. Training software such as KnowBe4, Infosec and Webroot should be implemented so that employees can be taught how to identify potential ransomware threats and then be tested with simulated scenarios during the workday. Redundant, online backups should be made of all servers and devices so that data can be restored elsewhere if an attack occurs. And, most importantly, the operating systems running on all devices used by all employees must be regularly updated. Making sure that your insurance policy includes cyber coverage to help offset the costs of any business interruption is also critical.
The researchers at the security firm Kaspersky Labs, who undertook a survey of more than 5,000 businesses around the globe, found that staff training is essential in raising awareness among personnel and that business owners must find ways to motivate their employees to pay attention to cyberthreats and countermeasures, even if they are not part of their specific job responsibilities.
“Installing updates, and managing personal passwords properly shouldn’t always be at the bottom of an employee’s to-do list,” the researchers warned. “Sometimes personnel may take cybersecurity requirements too lightly, leading to dramatic consequences for the organizations they work for.”
