{"id":3881,"date":"2017-04-18T12:29:26","date_gmt":"2017-04-18T16:29:26","guid":{"rendered":"https:\/\/www.insureyourcompany.com\/?p=3881"},"modified":"2017-04-18T12:29:26","modified_gmt":"2017-04-18T16:29:26","slug":"how-to-protect-your-small-business-from-a-ransomware-attack","status":"publish","type":"post","link":"https:\/\/insureyourcompany.com\/blog\/how-to-protect-your-small-business-from-a-ransomware-attack\/","title":{"rendered":"How to Protect Your Small Business from a Ransomware Attack"},"content":{"rendered":"

On the morning of February 5, 2016, a worker at\u00a0Hollywood Presbyterian Medical Center<\/a>\u00a0(HPMC) opened a suspicious-looking email. Later, he tried to access a patient\u2019s records on his computer, but couldn\u2019t. He went to his manager, who tried to help, but nothing seemed to work.<\/p>\n

Soon, other workers experienced the same problem. Within hours, CEO Allen Stefanek received the dreaded call: Hackers had infected the Medical Center\u2019s computer system with ransomware. They demanded Hollywood Presbyterian pay 40 Bitcoin, or $17,000 in ransom. For 10 days, the company refused to pay\u201410 strife-filled days without computer access.<\/p>\n

Eventually, they paid the money. Stefanek talked to reporters, stating:<\/p>\n

\u201cThe malware locks systems by encrypting files and demanding ransom to obtain the decryption key. The quickest and most efficient way to restore our systems and administrative functions was to pay the ransom and obtain the decryption key. In the best interest of restoring normal operations, we did this.\u201d<\/em><\/p>\n

Small Businesses Are Under Attack<\/strong><\/h3>\n

Hollywood Presbyterian could take some small comfort in knowing they were not alone. Of the\u00a027.9 million small businesses<\/a>\u00a0in the United States (99.7% of all companies),\u00a043% were the targets of cyber attacks<\/a>\u00a0in 2015, up from just 18% five years earlier.<\/p>\n

The attacks aren\u2019t limited to desktop computers; as cybercriminals become more sophisticated, they\u2019re attacking smartphones, smart watches, and even smart televisions.<\/p>\n

What Can Small Businesses Do to Protect Themselves?<\/strong><\/h2>\n

Cyberattacks generally come in two forms: (1) those in which the ransomware is attached to an email; and (2) those which infect the computer directly through the browser. Small businesses need to prepare for both.<\/p>\n

Here are\u00a04 steps you can take\u00a0to protect your small business from a ransomware attack:<\/p>\n

1. Back up Your Files<\/strong><\/h3>\n

Having a robust backup for your files gives you an alternative to paying expensive ransom to cybercriminals. As Philip Casesa, Product Development Strategist for\u00a0ISC2<\/a>\u00a0explains:<\/p>\n

“You have to have some sort of backup, a real backup solution of the assets you’ve determined are essential to your business. Real-time backup or file synch will just back up your encrypted files. You need a robust backup process where you can roll back a few days [to before the ransomware infection], and restore local and server apps and data.”<\/em><\/p>\n

Because ransomware can infect both primary and backup files, the best strategy is a \u201ctiered or distributed backup solution\u201d in which several copies of backup files are stored in different locations and on different media.<\/p>\n

2. Educate Your Employees<\/strong><\/h3>\n

Most ransomware attacks occur through infected emails\u2014either as links within the email, or as email attachments. You need to train employees to never open any email from someone they don\u2019t know.<\/p>\n

According to\u00a0McAfee<\/a>, you should train employees to be especially suspicious of email subject lines which invite them to connect on LinkedIn, claim to be an \u201cimportant communication,\u201d or say \u201cmail delivery failed.\u201d<\/p>\n

You can educate your employees by hosting training seminars hosted by security professionals, or more informally (and less expensively) through a series of lunches in which your IT people launch a group discussion.<\/p>\n

3. Centralize Security<\/strong><\/h3>\n

Small businesses in which each computer has its own antivirus security protection are most at risk. According to Casesa, moving to a\u00a0managed endpoint security<\/a>\u00a0solution in which IT maintains security for the entire business dramatically increases the effectiveness of antivirus and anti-malware software solutions.<\/p>\n

4. Don\u2019t Pay the Criminals<\/strong><\/h3>\n

There\u2019s a good reason the federal government has a policy of never paying terrorists to free hostages\u2014it tells them their strategy worked and encourages them to take more hostages in the future.<\/p>\n

The same principle applies to cybercriminals. When you pay, you\u2019re telling criminals that you\u2019re a ripe target for a subsequent attack (you\u2019ve become, in marketing parlance, \u201ca qualified lead\u201d) and encouraging them to attack other businesses.<\/p>\n

Does Insurance Cover Ransomware Attacks?<\/strong><\/h2>\n

Small businesses can buy insurance that covers ransomware attacks,\u00a0but should work closely with their insurer<\/a>\u00a0to design the best policy. Some cyberattack policies don\u2019t cover ransomware, and some that do have deductibles so high that paying the ransom is a more attractive option.<\/p>\n

The good news is that most cyberattack policies can be customized, which means you need to work closely with your insurance carrier to get the coverage the best fits your business for the best price.<\/p>\n

The one thing small businesses shouldn\u2019t do is bury their heads in the sand in the blind hope that they\u2019ll be spared a ransomware attack. In business, the best policy is to hope for the best, but prepare for the worst.<\/p>\n

Establish a security policy which assumes you\u00a0will<\/em>\u00a0<\/em>be a target. Take the appropriate steps to prevent such an attack, and to deal effectively with one if it does occur, and make sure you’re covered with a customized insurance policy.<\/p>\n","protected":false},"excerpt":{"rendered":"

On the morning of February 5, 2016, a worker at\u00a0Hollywood Presbyterian Medical Center\u00a0(HPMC) opened a suspicious-looking email. Later, he tried to access a patient\u2019s records on his computer, but couldn\u2019t. He went to his manager, who tried to help, but nothing seemed to work. Soon, other workers experienced the same problem. Within hours, CEO Allen […]<\/p>\n","protected":false},"author":5,"featured_media":3884,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[76,98,87],"tags":[99,313,239,461,450,473],"class_list":["post-3881","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-business-insurance","category-cyber-liability","category-technology-insurance","tag-cyber-liability","tag-cyber-liability-insurance","tag-cyber-risk-insurance","tag-cyber-security","tag-cyber-threats","tag-ransomware"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t