How to prevent
and avoid
ransomware 

How to prevent ransomware is becoming increasingly important as two high-profile events illustrate: Colonial Pipeline paid roughly $5 million to regain access to its business networks in order to start selling gas again, while meat supplier JBS paid about $11 million to bring its meat plants back online after a ransomware attack.

These types of large payouts may embolden other hackers, putting your organization at greater risk of an attack in the months and years ahead.

So just how concerned should you be about a ransomware attack? 

Anyone in the public or private sector has the potential to be a target of a ransomware attack. Verizon’s Data Breach Investigations Report highlights that ransomware has become a growing problem for public schools.

But it’s not just schools that are at risk. An article in TechTarget lists the 10 most vulnerable industries, but emphasized that regardless of the industry or size of a company, everyone is a potential target nowadays.

That is why it is so critical for companies to not adopt a “head-in-the-sand” philosophy, thinking that a ransomware attack won’t happen to them. Today, ransomware prevention is not only a critical IT initiative but also a critical business objective to help protect yourself from operational shutdowns and damage to your brand reputation.

So let’s take a look at how to prevent ransomware and help to lessen the chance of your company becoming a victim of an attack. 

Ransomware prevention describes the people, processes and technologies in place to improve your organization’s ransomware resilience.

How to prevent ransomware can include using automated tools, such as anomaly detection, creating immutable backups to speed your recovery and training staff to avoid clicking on suspicious links. Ransomware prevention can also include building out your cyber security framework for detecting, responding and remediating an attack so everyone knows what to do when the time comes.

Depending on the size of your organization and the structure of your attack surface, ransomware prevention can be a time-consuming, complex task. For example, you may not have complete visibility into how secure all your endpoints on the network truly are, especially with the rise of Internet of Things (IoT) devices that weren't expressly built with security in mind.

When looking for ways on how to prevent ransomware, don’t overlook remote employees. Remote workers may lack the protection of your corporate network, leaving them at a higher risk of downloading ransomware that could eventually make it back onto your servers. Employees working remotely also may be distracted, which could lead them to let down their guard when getting a suspicious email. That’s an open door to ransomware.

Knowing how to prevent ransomware requires knowing where to start. For some organizations, the weakness might lie in an unpatched endpoint, while for others it may involve untrained employees.

To help prevent ransomware, a security review is crucial to assessing your current level of incident preparedness so you can create a baseline to work from. This review will test your business to indicate your risk for ransomware, and it will provide industry benchmarks you can use to understand how, where and why you should direct your security investments.

Other tests also can help you understand where your technology, training or processes might be lacking when it comes to ransomware prevention. For example, during a Ransomware Attack Simulation activity, multiple ransomware behaviors are executed during a single session with the organization's blue team members. This simulation provides insight into the detection and prevention capabilities of the countermeasures that are already implemented. You can collect information related to the number of employees who execute the ransomware, visit the malicious payment portal and even attempt to pay the ransom.

When conducted by a third-party expert, you can better understand your security posture while gaining actionable recommendations for how to drive the most improvement for ransomware prevention based on your specific organization. In addition, an outside partner can help you conduct security assessments on a regular basis to ensure that the changes you're making to your cyber security controls and practices have a real-world impact on your ransomware prevention measures.

Is it possible to conduct a security review on your own? Yes, but keep in mind that your staff might not have the cyber security insight or knowledge of industry best practices to uncover every issue. An outside partner not only has deep experience in knowing how to prevent ransomware but also can help you contextualize threats so you know what to focus on first. In addition, a partner can provide the technology, services, intelligence, analytics and scale you need to quickly respond to ransomware threats, especially if you have a relatively small IT team or lack in-house ransomware experts.