Ransomware: how to reduce the risk to your business

Ransomware encrypts company data and demands a ransom to release it. Often, before encrypting, attackers also copy the information and threaten to publish it. For a business this means days or weeks of downtime, recovery costs and reputational damage. The risk can never be eliminated, but it can be greatly reduced.

How ransomware gets in

The most common routes are always the same: a phishing email with an attachment or link, stolen or weak credentials used for remote access, an internet-facing system that has not been updated. Once inside, the attacker moves through the network, looks for the backups and only at the end launches the encryption.

The measures that make a difference

• Updates to operating systems, applications, firewalls and network devices, prioritising anything exposed to the internet.
• Multi-factor authentication on email, VPNs, remote access and admin panels.
• Advanced endpoint protection, able to block behaviour typical of encryption and not just known files.
• Least privilege: users should not be administrators of their own PCs, and admin accounts should be used only when necessary.
• Network segmentation, to limit spread.
• Isolated or immutable backups, which the attacker cannot reach or delete.
• Training to recognise suspicious emails and requests.

Preparing for the worst

As well as prevention, you need to know what to do if it happens: whom to call, which systems to isolate, in what order to restore services, how to communicate with customers and suppliers, and which notification obligations to meet. A written, tested plan cuts reaction times when the pressure is highest.

Monitoring matters

Many attacks leave traces before encryption: logins at unusual times, repeated login attempts, antivirus being disabled. Continuous monitoring means you can spot them in time.

How we can help

Labinf Sistemi supports companies and public bodies with Cybersecurity services based on partner technologies such as Sophos, and with backup and disaster recovery solutions designed to withstand even a ransomware attack.

Want to find out how exposed your business is? Contact us.