In 2020, we saw an unprecedented rise in cyberattacks of all types, especially ransomware. Ransomware attacks exploded with a 485% increase over the prior year.
Ransomware is particularly devastating for a company because it spreads quickly and encrypts files throughout the network. In most cases, this brings an organization to a standstill and desperate to get operations back up and running as quickly as possible.
That’s why a majority of victims pay the ransom. For example, in the case of Colonial Pipeline, it paid $4.4 million in ransom to its attackers. JBS, the global beef and pork producer that was hit with an attack over Memorial Day weekend, paid $11 million in ransom.
There’s a new criminal business model that’s been driving this rise in ransomware attacks called Ransomware as a Service (RaaS).
RaaS is now responsible for nearly 2/3 of all ransomware attacks.
What is Ransomware as a Service?
In the early 2000s, the new software model of Software as a Service (SaaS) was introduced. Instead of purchasing software to run on individual devices or on-premises servers, software became a monthly subscription model. Companies gained access to an always-updated version of the software and the cloud provider took care of all the backend maintenance.
RaaS follows a similar model, only for the tools necessary to conduct ransomware attacks. Ransomware as a Service makes the ability to launch and profit from a ransomware attack available to any criminal, even if they can’t write a single line of code.
Where did this model come from? Mainly from large criminal organizations and state-sponsored hacking groups which were looking for another way to capitalize on the profitability of ransomware attacks.
The average ransom demand has continued to increase, and it’s now reached approximately $234,000.
Too many small and large businesses alike don’t have the proper cybersecurity and incident response measures in place, so they end up becoming easy victims.
Ransomware brings a fast “payday” for attackers in the form of a ransom payment, which makes it so lucrative and has led to the increase in attack volume.
RaaS Makes It Easy for Anyone to Conduct a Ransomware Attack
RaaS democratizes ransomware attacks, making it easy for novice wannabe criminals to try their hand at getting a quick payout.
It’s run very much like SaaS and will include pre-packed bundles of the assets necessary to conduct a ransomware attack. These services also often advertise help desk support, user forums, and flexible pricing packages. They’ll even have user reviews!
These bundled attack packages will typically include things like:
- Ransomware code
- Phishing emails to launch an attack
- Step-by-step guide for conducting a ransomware attack
- 24/7 support
There are a few different flexible pricing options that RaaS providers offer. This further makes it easy for anyone, even someone without a lot of money, to take a chance on a “get rich quick” attack.
The four standard pricing models are:
- Monthly subscription (starting as low as $40/month)
- Affiliate programs that include a subscription and percent of the profits
- One-time license fee with no profit-sharing
- Profit-sharing without the up-front subscription fee
The bottom line is that companies need to take stronger measures that include both preparedness and proactive defense to avoid falling victim to ransomware.
How to Protect Your Company from Ransomware
Use Advanced Endpoint Protection
Just having an antivirus/anti-malware on your PCs isn’t enough to prevent a successful ransomware attack. Deploy advanced endpoint protection systems that use zero-trust measures, such as continuous network monitoring and anomalous behavior recognition.
Use Managed Backups That Are Monitored
Back up your data frequently and use a managed backup plan that ensures backups are completing successfully and don’t get hung up or turned off by accident.
Ransomware makes your data unusable, and the only way to recover without paying the ransom or losing data is to have a complete backup of your data.
Create and Drill an Incident Response Plan
Companies like Colonial Pipeline that have a backup of their data often will pay the ransom anyway because they think it will be faster than going through a data recovery process.
It’s important to create a step-by-step incident response plan that lists everything your team should do in the case of ransomware or another type of critical event.
Run drills regularly on your incident response plan, including full data recovery, to improve efficiency and the speed at which you can recover your operations after an attack.
Have a Robust Employee Security Awareness Training Program
Ransomware attacks often originate with a phishing email that tricks a user into clicking on a malicious link or opening a file attachment containing the ransomware code.
Train employees on security awareness and how to avoid being scammed by phishing and conduct training on an ongoing basis, not just once a year.
Get a Security Assessment to Check for Ransomware Vulnerabilities
Unity IT can help your Fresno area business reduce your risk of falling victim to ransomware. We’ll do a full security assessment and let you know of any vulnerabilities in your network.
Contact us today to schedule a technology consultation at 559-297-1007 or reach out online.