Steps to take to prevent successful ransomware attacks include adequate backups, two-factor authentication and employee training, along with incident response and business continuity plans, experts say.
Backup systems that are strictly separate from primary systems are critical.
“First and foremost, have a backup that is regularly backed up, is accessible, and is separate from the primary data so a hacker can’t encrypt both primary and backups,” said John Farley, managing director of the cyber liability practice for Arthur J. Gallagher & Co. in New York.
Organizations should also have antivirus software on both their primary and backup systems, said Michael Born, senior vice president and cyber liability product leader at Berkley Re Solutions, a W.R. Berkley Corp. unit, in Overland Park, Kansas.
Companies should work closely with their cyber insurers on this issue, said Marcin Weryk, New York-based head of cyber-West and South at Axa XL, a unit of Axa SA. “We can not only save time,” but the vendors with which the insurer works can be helpful as well, he said. “The point is, if you have an insurance policy, make sure you use it,” he said.
Companies should also have a formal patching process to address vulnerabilities in their software once they become known, Mr. Farley said.
Experts also stress the value of two-factor authentication, which adds a second layer of security by confirming users’ identity.
Once companies that have been hacked obtain an encryption key to unlock their systems and data, they should have a forensics firm assess the key to make sure there are no back doors “leaving an easy way” for the hackers to return, said Dan Burke, San Francisco-based national cyber practice leader for Woodruff Sawyer & Co.
Employee training on phishing emails is also critical, said Ayesha I. West, vice president, cyber liability, at Everest Insurance, a unit of Everest Re Group Ltd. in New York. “Employees are the easiest vector for a criminal to get in.”
