Tag Archive for: backup

I’ve Been Hit by Ransomware… What Now?

/in ,

In an article titled “Best practices to remediate a ransomware attack” published through Business & Finance, Filip Verloy, Field CTO EMEA of Rubrik says, “As the use of remote working rises, so do potential threats and vulnerabilities, especially within a smaller business which might not have stringent home working security measures in place. People have been forced to adopt new ways of working at an accelerated pace.” Verloy states the importance of protecting your company from cyberattacks that could come as a result of remote working. He advises every company to “create a ‘work from home guide’ for employees, explain which tools are ok, what basic security measures are expected, and who is responsible for implementing them.”

The FBI has estimated that ransomware will be a $1 billion market in 2021. If a company or organization is not prepared, they may feel that paying the ransom is their only option. The recovery process can be very difficult because it is both expensive, and there is no guarantee you’ll get all your files back. Waiting until you fall victim to a cyberattack in order to develop a data recovery plan is not effective and can be detrimental to your business. It is important to decide now on a backup and recovery solution to ensure your data is secure.

Business & Finance published “Best practices to remediate a ransomware attack” to help you develop your ransomware remediation plan just in case an attack occurs.

You Have Been Hit by Ransomware – What Now?

1. Isolate the infected station from the network.

This is done to prevent the infection from spreading to other devices. Disconnect the network cable, WiFi, USB’s, etc. and turn the power off the affected devices to try and contain the damage.

2. Ensure backups have not been compromised.

Be sure backup data is not in read/write mode because it can be manipulated or deleted by the attacker.

3. Identify the infection.

Ask yourself the following questions: What kind of ransomware are you facing? How did it enter your system? Phishing scam? Stolen user credentials?

4. Determine your options.

There are several options available as you try to recover from an attack: pay the ransom, try to remove the malware, and recover from backups. Unfortunately, paying a ransom does not guarantee the recovery of all your data, and may encourage the attacker further because their attack was successful. Trying to remove the malware has become increasingly difficult as ransomware has become more sophisticated and mutates frequently. If you have a robust backup system, you should be able to restore all data from the most recent backup without paying the ransom.

After you have taken these steps, be sure to notify your team, discover which files are corrupted, restore your files, and inform law enforcement, customers, and other authorities. 

How to Prepare

One of the best ways to prepare for a ransomware attack is to make sure your data is backed up in multiple places. Joel Witts with Expert Insights said, “In the event of a ransomware attack, backing up data means you will be able to mitigate the loss of any encrypted files and regain functionality of systems.”

Trinsio offers full-featured, Rubrik-powered data management with global searchability, instant recovery, and data immutability. We also offer local and cloud data replication to be sure your data is secure. With more than 30+ years of experience in cloud, data center colocation, and communications, Trinsio can provide you with a solution you can trust.

We Critiqued Organizations’ Reactions to Recent Ransomware Attacks

/in , ,

With ransomware so often in the news, are organizations really shaping up their IT infrastructure? Organizations are increasing cybersecurity budgets and investing in security metrics to avoid being subject to data breaches. Despite their efforts, the number of successful cyberattacks are increasing, along with the number of companies who feel that they are likely to be compromised in the following year (Source: CyberEdge). 

What’s the best way to determine how prepared organizations really are? Test them. One way or another, the organizations will be tested, it is just up to the owners whether it is in a controlled environment or the real deal. And since some organizations have recently been “tested”, let’s see how they responded. 

Travelex 

If this were a college course, Travelex would have failed and been required to retake it. Unfortunately for them, after this attack, they definitely will “retake it” some day, and probably soon. Travelex, a London-based foreign exchange company, paid a staggering $2.3 million worth of bitcoin to hackers to reclaim access to their computer systems which were compromised by a ransomware attack discovered on New Year’s Eve 2019. A group who claimed to be behind the attack said they had access to the company’s data 6 months earlier, since the summer of 2019.

Despite paying the ransom, Travelex was not able to get its business back to regular operations until over one and a half months later. Only the company’s website remained operational in the attack, with online transactions suspended, and locations being forced to return to physical records. 

Overall Score: Very Poor

Overall, Travelex’s response to the New Year’s Eve ransomware attack was very poor. They didn’t discover it for 6 months, and were severely under prepared, with no backups to get them back to working order quickly. 

Preparation: Very Poor

Discovery: Very Poor

Reaction: Very Poor

Recovery: Very Poor

Coffee County Sheriff’s Department

Coffee County Sheriff’s Department in Tennessee was attacked last Monday by ransomware. Employees at the jail noticed files mysteriously moving earlier, but discovered that their entire system was encrypted Monday morning. The compromised data included files and arrest, booking and sentencing records for all the inmates. They were sent a ransomware demand, but are instead electing to use paper back-ups. 

Overall Score: Poor

While the sheriff’s department did not pay the ransomware demand, they were still inadequately prepared for the attack, and are now being forced to use paper backups, which is painful and slow. Other working backups could have decreased down time significantly and prevented data loss. Additionally, the employees were not trained well enough to understand what the suspicious movement of the files meant. If the employees had understood, some or all of the lost data could have been prevented. 

Preparation: Poor

Discovery: Very Poor

Reaction: Moderate

Recovery: Very Poor

 Finastra

The data breach that began in mid-march was discovered after the hackers’ malicious activity set off an alarm from one of Finastra’s cloud servers, alerting its security team. After being discovered, the hackers worked quickly to begin the ransomware attack. To prevent irreversible damage, Finastra took the affected servers offline, which also stopped delivering services for many of its customers. This came at a time when Finastra was working on new emergency plans due to COVID-19.

Overall Score: Moderate

While Finastra did react quickly to the ransomware attack, their preparation and recovery were very poor. Finastra neglected to fix many known software issues, which aided the hackers in their attack. Finastra correctly refused to pay the ransom, saying “Paying the ransom just makes you a bigger target for next time,” however, recovering and rebuilding their servers from their backups will be a long and painful process, leading to long amounts of downtime and service loss. 

Preparation: Very Poor

Discovery: Moderate

Reaction: Excellent

Recovery: Poor

Durham City

Last month, Durham City, North Carolina, was hit with ransomware. The malware spread after an internal employee clicked on a malicious email. After discovering the ransomware, the city quickly took affected systems offline as part of their cybercontingency plan. They were then able to quickly restore systems from working backups which had not been compromised by the ransomware because of their immutability and distance from the on-site data.

Overall Score: Excellent

Durham City was well prepared to combat the ransomware attack with a cybercontingency plan and working, fast backups from Rubrik. Additionally,the city routinely and frequently holds security trainings for employees to prevent them from falling prey to phishing emails. They were quick to react and recover, preventing extended data loss and down time. 

Preparation: Good

Discovery: Excellent

Reaction: Excellent

Recovery: Excellent

Guaranteed Excellent Recoveries

Rubrik is an award-winning, industry-leading, enterprise-level backup and recovery service that leverages an all-in-one software to bring you near-zero RTOs and instant recovery. Rubrik requires little daily management time, so you don’t have to babysit your backups all day to make sure they are ready when you need them.

Businesses not only save up to 50% when switching to Rubrik (and more with Trinsio), but they get more relevant, security-focused services like immutable backups and ransomware detection with Polaris Radar.

Not convinced? Try Rubrik free for 30 days with Trinsio. Sign up here or contact a Trinsio representative to get started.

The Coronavirus + Your Business

/in ,

As the number of infected by the Coronavirus grows in the US, more local governments and businesses are taking action to prevent contracting the virus. Eight states, including Utah, have declared a state of emergency. Governor Herbert said about declaring a state of emergency: “Making this declaration simply opens up resources for Utahns and allows us in government to focus as seriously as possible on being prepared.”

Meanwhile Individuals are taking to the internet, preparing by doing their own research and watching Contagion (it’s okay, we did it, too) and buying face masks (even though the CDC says only the sick need to wear them). But what are businesses doing to prepare for the virus and how will it affect them?

Quarantined Consumers Versus the Internet

For businesses, the effect of the virus goes beyond employees asking for sick leave or working from home. Some companies such as Twitter, LinkedIn, and Microsoft (all together 75,000 employees working from home in the US) have already asked employees to work from home. Meetings and conferences are already being cancelled or delayed until the summer, like Rubrik Forward, which just made the decision to cancel all physical events and instead to make the conference digital. 

However, a more drastic change for businesses will be customer preferences as their customers work from home. As more customers begin to use services from home, they will be more reliant on internet services, and connectivity will become more important to them. Security incidents will be harshly critiqued, and loss of service, even for short periods of time, will be enough to convince customers to look for more stable options. 

“Businesses who are inadequately prepared won’t be able to live through cyber breaches as consumers become more dependant on reliable internet services while working from home,” says Lane Livingston, CTO of Trinsio. “Businesses need to prepare now for the shift in consumer preferences forced by the Coronavirus.”

And to add an extra challenge, as customers become more intolerant of service interruptions, scammers and spammers are taking advantage of the ignorance, misinformation, and fear of citizens. The internet has seen an increase in scams related to the Coronavirus, asking people to donate, buy supplies, or click on links to see updated lists of infected cities, etc., some even impersonating the CDC to add legitimacy to their messages. So while your customers are on you for service interruptions, malware operators are working double time to wreak havoc on your business and provide your customers with more reasons to leave. 

Steps Your Business Should Take

While problems seem to be coming at you from both sides, what can you be doing to protect your business from the consequences? Here’s five things you can do now to keep your consumers happy and the hackers at bay. 

1. Use a good spam filter. A good spam filter will prevent a lot of the malicious mail from even getting to your mailbox, giving you a lower chance of clicking on something malicious. 

2. Train employees. A spam filter will not catch everything, so it is important that employees are aware of what to look for in malicious email. 

3. Set up antivirus software and a firewall. In information security, the more layers between your company’s information and the hacker, the better. 

4. Keep software and hardware up to date. Updated software and hardware will have the least amount of known bugs, giving hackers less opportunities to worm their way into your systems. 

5. Back up, Back up, Back up. Having a good backup system is a crucial part of any IT infrastructure, so that when the other parts of your system fail, your business has something to lean back on. And with customer tolerances of down time decreasing, it is also crucial to have a backup system that you can recover from quickly, preventing unnecessary down time. 

To learn how you can try a state-of-the-art backup solution for free, visit our website, or call (385) 283 – 1810.