Four steps to surviving ransomware

April 2017 Information Security, Security Services & Risk Management

According to Symantec’s 2016 Internet Security Threat Report, ransomware attacks increased by 35% in 2015. A survey by Malwarebytes found that nearly 40% of companies suffered a ransomware attack in 2015-16.

Al de Brito, senior technical analyst, ContinuitySA.
Al de Brito, senior technical analyst, ContinuitySA.

Ransomware usually arrives on a device via a sort of phishing attack, and can then spread to other devices on the same network. Either data files or the Master Boot Record are targeted. In the first case, data files are encrypted, in the latter, the device itself will not start up. Each type of attack comes with a demand for a ransom payment before access to the data or device will be restored.

Ransomware has become big business and payments are usually requested in Bitcoin, the cryptocurrency whose major characteristic is its untraceability. Based on our experience with a wide range of clients, the following key steps will help companies avoid falling victim to a ransomware attack and, in the event of one occurring, to be resilient enough to recover quickly.

Develop and implement security policies and procedures

The first step obviously is to spell out formally what the company’s risk profile is, and how all its employees need to behave in order to reduce risk. Some basic inclusions would be to require all users to ensure that they install all software updates, especially those relating to antivirus software, as well as firmware updates for hardware. Another key point here would be to ensure that these policies and procedures fall within the governance framework, and that administrators and security staff work closely together.

A word of warning: the solution is not simply to try and close everything down, but rather to specify safe habits. For example, data sticks will always be used, so rather than try to prohibit them, companies should ensure that scanning and encryption programmes are available and are used.

It is also critical that an ongoing programme for educating staff and enhancing awareness is in place.


Companies must understand which security standards are mandatory for particular industries and build them into their policies and procedures. Care must be taken to remain compliant over time and as regulations change. The other side of assessment is to put mechanisms in place to ascertain whether systems have been breached. Regular penetration and vulnerability testing must be implemented to establish the system’s integrity.

Monitor and investigate

Companies need to keep abreast of developments in ransomware and other security threats. This will provide early warning of new measures that need to be integrated into the security policies and procedures. Many companies use a service provider to handle this because it is highly specialised and requires familiarity with the Dark Web, where hackers operate.

Put a comprehensive response programme in place

In the event that an attack does occur, the company needs to have a well-thought-out set of responses in place to ensure it can recover within the shortest possible time. This will include a crisis communications protocol for dealing with the media and clients. It makes best sense to integrate the response to a ransomware attack into the business continuity plan because that will mean that the data will be backed up and recoverable at the disaster recovery site, and alternative devices and servers will also be available at the work-area recovery site.

However, it is very important to ensure that the disaster and work-area recovery sites are as highly secure – if the production site is compromised, bringing the disaster recovery site up will make it vulnerable.

For more information contact ContinuitySA, +27 (0)11 554 8050, [email protected],

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

New ransomware using BitLocker to encrypt data
Technews Publishing Information Security Residential Estate (Industry)
Kaspersky has identified ransomware attacks using Microsoft’s BitLocker to attempt encryption of corporate files. It can detect specific Windows versions and enable BitLocker according to those versions.

Using KPIs to measure smart city progress
Axis Communications SA Residential Estate (Industry) Integrated Solutions Security Services & Risk Management
United 4 Smart Sustainable Cities is a United Nations Initiative that encourages the use of information and communication technology (including security technology) to support a smooth transition to smart cities.

Enhancing estate security, the five-layer approach
Fang Fences & Guards Residential Estate (Industry) Integrated Solutions Security Services & Risk Management
Residential estates are designed to provide a serene and secure living environment enclosed within gated communities, offering residents peace of mind and an elevated standard of living.

Create order from chaos
Information Security
The task of managing and interpreting vast amounts of data is akin to finding a needle in a haystack. Cyberthreats are growing in complexity and frequency, demanding sophisticated solutions that not only detect, but also prevent, malicious activities effectively.

Trend Micro launches first security solutions for consumer AI PCs
Information Security News & Events
Trend Micro unveiled its first consumer security solutions tailored to safeguard against emerging threats in the era of AI PCs. Trend will bring these advanced capabilities to consumers in late 2024.

Kaspersky finds 24 vulnerabilities in biometric access systems
Technews Publishing Information Security
Customers urged to update firmware. Kaspersky has identified numerous flaws in the hybrid biometric terminal produced by international manufacturer ZKTeco, allowing a nefarious actor to bypass the verification process and gain unauthorised access.

Responsible AI boosts software security
Information Security
While the prevalence of high-severity security flaws in applications has dropped slightly in recent years, the risks posed by software vulnerabilities remain high, and remediating these vulnerabilities could hinder new application development.

AI and ransomware: cutting through the hype
AI & Data Analytics Information Security
It might be the great paradox of 2024: artificial intelligence (AI). Everyone is bored of hearing it, but we cannot stop talking about it. It is not going away, so we had better get used to it.

Local manufacturing is still on the rise
Hissco Editor's Choice News & Events Security Services & Risk Management
HISSCO International, Africa's largest manufacturer of security X-ray products, has recently secured a multi-continental contract to supply over 55 baggage X-ray screening systems in 10 countries.

NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.