How to protect your business from ransomware

Posted: April 12, 2016 by Wendy Zamora
Last updated: May 22, 2017

Ransomware has been a pervasive and dangerous threat to the business community for over five years. Seems like everywhere you turn, there’s another story about a new ransomware attack. And then, on Friday, May 12, the big one hit: WanaCrypt0r infected tens of thousands of endpoints in 150 countries, resulting in the largest ransomware outbreak in history. Unfortunately, this trend in cybercrime is not going away.

Now here’s the bright side: As dangerous as ransomware can be, it’s avoidable. So instead of closing your eyes and praying it all goes away soon, take a look at this infographic to see what you can do to protect your business from this ubiquitous threat.

Click here for the PDF version.

prevent ransomware

COMMENTS

DeeEcks

Patching up the OS isn’t really much of a need when you’ve got weekly offsite backups for basic consumers.
Peach Drinkwater

well it does save quite a pain of getting infected in the first place as well as cleaning and restoring from a non infected backup
Alex Helton

Can ransomware trash Dropbox folders?
floyd kelley

From my understanding, Dropbox for Business uses versioning for their files so a recovery would be as easy as rolling back the last known good version and overwriting the encrypted data.
jwmort

Yes. Dropbox is on a local drive and then is synchronized to the cloud. It will not only encrypt your local and cloud based Dropbox, but it will also sync with the other computers that you share Dropbox with.
Rick Murch

What we’ve been successful with is Shadow copy this has thwarted ransomware several times for us.
jjawm

Do some IT work on the side, and I ran into a ransom ware that said that it encrypted user files, upon further inspection found all of the file extensions had been renamed to some garbage. Renamed the extensions back to the proper name and all was well, so check before you go all crazy, because it could be as simple as all that. Just a word.
Rick

Does Malwarebytes not protect you to prevent getting infected?
Chris H

Ya, if you are VERY lucky. Ours just recently got named to .LOL! renaming didn’t work, they were still encrypted 🙁
Chris H

Yup. Had it happen to a user this week
Chris H

A LOT of info can be lost in a week of work though…that’s a scary mindset to have
Mark Hays

You have got to be kidding! Have you read the latest security alerts from Apple and Microsoft for their most recent patches? Every cybercrime group on the planet knows that these vulnerabilities exist as soon as (or before) the patches and descriptions are released. It is easy for cybercrime bot nets to quickly survey millions of computers to find those with an old version of the OS — vulnerable to the new attacks. So if you want to invite cybercriminals to seize control over your computer, monitor all of your keystrokes, IDs and logins, steal or encrypt your data, and plant a backdoor that others can use, DON”T patch your OS! Offsite backups often become infected / encrypted too, as others have noted — so this is no reason to be unconcerned about OS updates.
Heinrich Venter

Except that most ransomware deletes shadow copies as standard…
Heinrich Venter

What we actually need is a program / utility that can be set to monitor a specified set of folders for encryption taking place. I.e. we normally have a ‘groups’ folder share which clients have access to, a utility running on the server that would monitor that share for file encryption taking place will prevent thousands of files from being encrypted, you may end up with a few encrypted before the utility catches it, however much better than the whole share.
Heinrich Venter

Recovery through versioning doesn’t help if you have to recover a few thousand files across multiple folders. Way too much work since they need to be done on a file by file basis?
Dan Oltean

Happend here also :(. The only way to avoid that is to set up your cloud to sync manually, not automatically .When you are sure that your files on your local drive are ok, then you can do your sync. I think is the best method for now
DeeEcks

Too bad I don’t click dumb links. 5 years no patches, still have all my money on my bank account that I login every week.
DeeEcks

Not for me, I don’t have any personal documents stored. All hard copied.
Carlo Matos

Dropbox (all versions including the free versions) has that feature. I wouldnt call it easy to roll back, but it can be done. You have to roll back each file individually which makes it a long process depending on how many files you need to recover. We had to recover a client from ransomware this way before.
Jay Marasigan

We actually recently got the .LOL! as well. Did you guys do anything in terms of preventative action and were you guys able to find the source?
Glynn Smith

Yes had customer with infected dropbox files.
Ryan Salinger

Could you use the “Previous Versions” on your files on the dropbox website?
Jeni Anderson

Backup files in Offsite is better than storing it on online. And educating employees or system owners about the hack will prevent from ransomware.
Chris H

Probably not. Crashplan however does allow this. When we got hit, I just went to the latest backup (5 min before the infection) and everything was fine.
Chris H

I never found the source unfortunately. I talked them into getting Malwarbytes Business so it would scan in real time and every night and haven’t had any issues since.
Keith Ullman

There are a couple of problems with that. The first is that encrypting files is not in itself a malicious activity. It’s part of the capabilities of most modern OS’s. The second issue is that the running encrypting process is acting from an infected client machine so the server doesn’t see the CPU process, only that the files were changed. I believe that part of MalWareBytes defense does include watching/stopping certain encrypting activity on the client machines. Please do correct me if I am wrong about that.
Keith Ullman

Offsite backup is an essential protection against burglary and fires, etc. For many small companies using external backup drives, just unplugging them until the end of the day protects them from infection during the busy dangerous times. If the backup drives are only accessed from the server then you can limit access to the ID that runs the backup. If you have workstations backing up to shares on a server you can script un-sharing and re-sharing on schedules. Of course the more often you can detach and rotate your storage, the less you will lose to an encryption attack that might hit your backups.
Kevin Morrison

You are correct Keith and the problem needs to be resolved with the user permissions on the affected computer. If this was programed into the OS there is no reason encryption could not be controlled and managed with user based control. This is already in place with most OS’s and cannot be done without the proper permissions. There is no reason an OS cannot be programmed to better control this and ensure the user, or program even has the proper permissions to run the request!
Kevin Morrison

Even the most rudimentary hackers know to delete all shadow copies when the attack begins. The only way your idea will work is if the shadow copy is put on a different backup system, completely separate from the computer being attacked. Otherwise it will just be easily deleted.
Kevin Morrison

You have not dealt with a lot of end users have you. Educate employees… are you serious?

RELATED ARTICLES

101 | FYI

Stopping malware distribution at the source

May 9, 2012 - At Malwarebytes we are a bit obsessed with protecting our users, which causes us to approach our jobs from all sorts of different angles. One of my favorite aspects of this is how we tackle malware right at its source: the servers that deliver it. Our team works around the clock to identify and block...

CONTINUE READING 13 Comments

101 | FYI

Telephony Scams: Can You Help?

May 24, 2012 - Back in 2009, I wrote about a telephony based scam that had gained momentum, and which sadly appears to have grown since then — invading other countries and scamming more victims. Since then, various other people, including my friends at Microsoft, have been investigating the companies involved, to try and both raise awareness and shut...

CONTINUE READING 3 Comments

101 | FYI

Phishing 101: Part 1

June 29, 2012 - This week, there is a lot of media hype over emails being sent to users of the Royal Bank of Scotland and NatWest because of severe IT issues making it impossible for users to access their accounts online. The emails offer users the ability to log-in to their accounts and provide a link to the...

CONTINUE READING 3 Comments

101 | FYI

Phishing 101: Part 2

July 3, 2012 - “Over the years, phishing attacks have changed, as with most things, and have been segmented into different groups of variants.” –Me If there is one thing you can say about cybercriminals, it’s that they are adaptive. As I mentioned last week, phishing attacks have evolved from just fake web pages and official looking emails to...

CONTINUE READING 2 Comments

101 | FYI

Phishing 101: Part 3

July 13, 2012 - Over the last few weeks I have described numerous methods of phishing attacks and a few examples what they do or may look like. In this final installment, I will shed some light on how phishing attacks are done and a few real world examples of techniques used by Phishing scammers. Finally, I will discuss...

CONTINUE READING 3 Comments

ABOUT THE AUTHOR

Wendy Zamora
Senior Content Writer

Masters in Journalism from Stanford, but don't let that fool you. Expert in writing down what other people say and typing it up.

CATEGORIES

101 Cybercrime Malwarebytes news PUP Security world

SEARCH LABS

TOP POSTS

How to protect your business from ransomware

Stopping malware distribution at the source

Telephony Scams: Can You Help?

Phishing 101: Part 1

Phishing 101: Part 2

Phishing 101: Part 3

Cybersecurity info you can’t do without