Six Best Practices for Ransomware Protection

According to the Veeam 2024 Data Protection Trends Report, 76% of organisations, including those from Australia, suffered a ransomware attack at least once in the past 12 months. Worryingly, a significant number of organisations are experiencing multiple attacks: 26% reported being attacked four or more times this past year. Over time, this can account for billions of dollars lost to cybercrime each year. Organisations which know how to prevent ransomware attacks, or protect their data against attacks, can save themselves from significant recovery costs, reduce business disruptions and safeguard their reputation.  

Implementing ransomware protection measures at an early stage is crucial. Once under attack, attempting to salvage data without robust ransomware measures in place is likely to be futile due to increasingly sophisticated ransomware able to penetrate networks and access attached backups and storage. 

Understanding Ransomware

Ransomware is a form of malware that comes in many forms, from simple “scareware” that pops up a message asking for a ransom, to slightly more sophisticated screen lockers that can lock people out of their devices. Encrypting ransomware is one of the most damaging types of malware which encrypts an individual’s, company’s or an organisation’s most important files by creating a public-private pair of keys. The victim of an attack can only access this key to decrypt their files if they pay a ransom. 

A more sinister form of ransomware is doxware, which is used by malicious developers to threaten to release sensitive documents found on infected machines. Cryptocurrency is often the payment of choice for ransomware attackers due to the anonymity of these tokens. Such attacks have now become a big business, with professional hacking companies even offering “Ransomware as a Service” and attacking high-profile companies. 

Top 6 Best Practices to Protect Against Ransomware

While prevention may seem like the best solution, it is nearly impossible to prevent all current and future threats since malware prevention is an ever-evolving battlefield. For a start, practising basic cyber hygiene, which includes using antivirus software, choosing strong passwords and endpoint protection tools, all help reduce the risk of attacks. Additional measures can minimise the damage that a ransomware attack is likely to do. 

1. Use Immutability Wherever You Can

Establishing immutable storage targets can provide a safeguard against ransomware attacks. Historically, implementing this measure was challenging. However, contemporary data protection and backup solutions have simplified the process of creating immutable targets and storage pools, offering enhanced protection for your data against ransomware threats. 

2. Create Encrypted Backups

If you haven’t started encrypting your backups, it’s essential to begin doing so now. Since backups are not designed for frequent access, any potential performance impact from encryption is minimal. The security benefits of encrypted backups are too beneficial to ignore. Encryption would not make it more difficult for ransomware attackers to access your data but would help prevent other unauthorised access and data leaks. 

Encryption keys should be stored securely and only accessed by authorised individuals when needed. 

3. Verify Your Backups Regularly

Check the integrity of your backups and verify that any automated backups you’re running are taking place as you’d expect them to. This process is quick and easy to put in place, and provides reassurance that data can be retrieved at any time. Spending a few minutes each week or month to double-check your backups could save you and your IT team a lot of stress if you ever need to implement your data recovery plans. Regularly conducting automated simulations of your recovery plan could be included as part of this process. 

4. Limit Access to Backups

Every user with access to your backups represents a vulnerability. The most prevalent method for data breaches is through stolen credentials. Restricting access to your backups diminishes the potential impact of data breaches. In an ideal scenario, everyone would opt for secure passwords, avoid reuse, and adhere to multi-factor authentication best practices. 

Unfortunately, human errors and risky behaviors are inevitable. As a systems administrator, your responsibility is to minimise these risks as much as possible. Restricting user access to only what is necessary is a pragmatic initial measure. 

5. Proactively Monitor Your Systems

Ransomware is rapidly evolving, and there’s no guarantee that antivirus and malware software will detect the latest variants. Using tools to monitor indicators of compromise can assist in identifying an infection before significant harm occurs. For instance, noticing alterations in backup jobs or changes to seldom-touched files may indicate a potential issue. 

Receiving alerts for indicators of compromise enables you to proactively take data offline or transition to a “clean room” environment, allowing for an investigation into the root cause of unusual behavior — ideally, before any lasting damage occurs. 

6. Have a Data Recovery Plan

A data recovery plan should be a part of your broader business continuity strategy. If you still need to get a formal plan in place, initiate the process. If you do have a plan in place, test it regularly. And if you’re already following best practices and doing regular backups, it may instil confidence in its functionality but always remember to ask yourself this question:  does this cover all the files you need? 

Conducting roleplay scenarios can help to see whether you can recover all the data you need in the event of attacks on specific systems. Consider what you’d do if you had to shut down certain systems while removing malware from your network. Instead of assuming plan adequacy, perform regular testing and reviews, especially after process changes or the adoption of new software. Documentation of recovery plans should be thorough and familiar to stakeholder teams responsible for execution. 

Protect Your Data From Ransomware With Veeam

Ransomware continues to be one of the biggest threats to businesses of all sizes. Since the tools used by attackers are so sophisticated, it can be challenging to protect yourself against these attacks. Simply storing backups on the same network as your current data is insufficient protection against ransomware. Malicious software can actively navigate the network, aggressively seeking files for encryption. 

To ensure comprehensive data protection, you’ll need to take encrypted backups that are stored separately from the files you use for your daily operations. This redundancy ensures that copies remain available even if an attack goes undetected or in the event of an outage or backup-related issue. 

Charles Clarke is Senior Director, Solutions Architecture, Americas at Veeam

Anthony Spiteri is Regional CTO APJ at Veeam

Last Updated on October 9, 2024 by Anthony Spiteri and Charles Clarke