NEWS ANALYSIS: The FBI issues a warning about the prevalence of new ransomware attacks that includes tips on how businesses can avoid being victimized.
Ransomware attacks on businesses in the U.S. are growing faster than ever and few businesses are ready to handle them, according to a bulletin from the Federal Bureau of Investigation.Cyber criminals are also attacking a much broader range of businesses, including attacks on health care facilities and critical infrastructure as well as launching attacks more frequently, according to the bulletin.In April, the city of Lansing, Michigan reported that its water and power utility had suffered such an attack.Unfortunately, the FBI has determined that businesses are unequipped to deal with a ransomware attack, despite the fact that such attacks have been around for a few years and have received broad publicity. Attacks on hospitals in Hollywood, Calif. and in Washington, DC have made the national news, but little seems to have changed in terms of companies' preparedness to defend themselves from an attack. Part of the problem, of course, is that companies may not be sure what to do about an attack. Another reason may be that the costs are unknown, so it’s hard to make a business decision regarding ransomware. “What’s amazing to me is that with all of this going on for this many years is that people are still opening attachments to emails,” said Jack Gold, principle analyst for J. Gold Associates. Gold is referring to the practice of cyber-criminals to send emails to a targeted list of individuals with malware infected attachments. When the recipients open the email and either click on an attachment or in some cases click on a link to a website, malware infects victims' computers and networks. “Most of the breaches are [are the result of] phishing attacks, with somebody doing something silly, such as opening an email attachment,” Gold said.Gold added that while most antivirus software will find malware in an email, there are plenty of ways to attack your network that the AV software misses. He said that the reason these attacks work is that there isn’t necessarily a technology solution. “At the end of the day, if people are going to do something silly, it’s hard to get past that,” he said.Unfortunately, many organizations simply don’t focus on the problem of dealing with malware attacks including ransomware. Ask most top level managers how much their data is worth or what would happen to their business if it was lost, they are likely to say they simply don’t know.Likewise, those managers don’t know whether they have adequate backups, whether those backups could be restored, or how long it would take to recover from such a data loss.This is likely part of the reason those businesses aren’t taking adequate protective measures. They can find out how much it costs to perform some tasks, but putting a cost to training employees to avoid an attack, not to mention making sure their data systems aren’t vulnerable remains a mystery to many. Unfortunately, many in business aren’t sufficiently motivated to find out.
- eWeek