Imagine having one-fifth of your company’s operations completely knocked out in a single, swift motion. That’s what happened in May 2021 to JBS USA, one of the biggest meat processing companies in the world. Their meat plants were forced to halt production in multiple states throughout the U.S., as well as at plants in Australia and Canada. The food supply chain panicked, scrambling to find alternative meat suppliers as thousands and thousands of meat deliveries were canceled. This incident caused multiple waves of economic uncertainty for consumers, grocery stores, restaurants, other food processors, and more.
What caused all of this chaos? An effective, well-orchestrated ransomware attack. And sadly, this is only one example of many recent ransomware attacks. If JBS was using stronger ransomware protection as a service, this may not have happened. This example was not meant to scare you; instead, it’s meant to educate you on why ransomware is a problem. In this blog, our team at InterVision hopes to provide you with some ransomware protection best practices so you don’t have to experience what JBS went through.
How Does Ransomware Work?
The overall concept of ransomware is quite simple. The hacker infiltrates your computer or database, encrypts or locks your data, and refuses to give your data back until you pay a ransom. Let’s briefly review the details of each part of a ransomware attack.
- Infiltration – Infiltration is probably the hardest part of this process for the attacker, but it’s made easier when organizations don’t use any type of ransomware protection. With limited or no protection, a malicious bad actor or hacker can infect your system in many ways, such as tempting an employee to innocently click a link in a phishing email or website ad that downloads this malware.
- Encryption – Once the hacker is in, encryption is relatively easy, since encryption functionality is already available on most operating systems. Encryption transforms your data into an unreadable format that only authorized users can understand using a special key to decrypt the data. This is a helpful tool for your own security purposes when you have the key to that data, but it can be quite harmful when an attacker is the only one holding the key to that encrypted data.
- Ransom – Usually the main purpose of a ransomware attack is the final payout. To get this, the attacker will send a ransom note to the business after successful encryption. The threat of the ransom note may only be to never restore your data, or the attacker may also threaten to produce some of your more private data to the public. This note will also give instructions on how to pay the attacker and get the keycode to decrypt the data, restoring everything to normal once more.
Educating yourself and your employees is the first of many steps that give you protection from ransomware. Our InterVision team employs many other techniques to prevent, stop, and respond to these attacks, which we will discuss below.
What Is Ransomware Protection?
One common question we get asked at InterVision by new clients is, “Does antivirus protect against ransomware?” The answer is ‘sometimes.’ Antivirus can warn a user of ransomware, but only if that particular ransomware is in the database of the antivirus. Another point against antivirus is that 87% of users completely disregard security messages when they interrupt the user’s primary task, which is pretty much all antivirus does.
When figuring out how to prevent ransomware, it’s important to note that preventing ransomware isn’t a one-and-done process. Antivirus defense is only one potential brick in the wall that organizations need nowadays for full cyber protection. Each part of ransomware prevention must also be consistently monitored and updated to compete with constantly evolving ransomware techniques. With these issues in mind, here are the questions we asked ourselves when developing our Ransomware Protection as a Service™ (RPaaS™):
- How can we defend against known and unknown ransomware threats?
- Where can we strengthen baseline Security Incident & Event Management (SIEM) to further support RPaaS?
- What’s the most efficient and secure way to facilitate Disaster Recovery as a Service (DRaaS) to recover data already lost to a ransomware attack?
- How can we protect our customer’s data from encryption, deletion, and/or alteration?
- How should we engineer our preventative measures to offer real-time monitoring?
- How can we oversee and guide the maturation of security and risk mitigation?
These are also excellent questions for you to consider when figuring out the best methods for preventing a ransomware attack on your business.
Trust InterVision’s Ransomware Protection as a Service™
To conclude the story of JBS, they ended up having to pay $11 million to the ransomware attackers. And while this is a much larger company, a hacker’s target can be a big or small business, or anywhere in between. In a survey in 2020 by Forrester Technographics Security, 59% of businesses reported that they had been victimized by ransomware.
Fortunately, there are many defensive measures a business can take against ransomware. One of our goals at InterVision is to build and strengthen this protection for our clients. We take a holistic approach with our RPaaS, which goes beyond basic security and backup tools. Whether you’ve been attacked and need help with recovery or you’re looking to stop the attack from happening, we can help. As we always say, when it comes to a ransomware attack, it’s not if; it’s when! Let us help protect and grow the valuable asset that is your business. Contact us today to learn more about fortifying all your IT operations and stopping ransomware before it stops you.
