Tips For Preventing Ransomeware

Once you've been the victim of a ransomware attack, it's already too late. The only practical solution is to pay up. Even large companies have realized that paying is the only way out of their predicament. When Colonial Pipeline was attacked by ransomware, the only way they got their system back online was to pay the $5 million ransomware price tag. When JBS (meat processor) was attacked, they had to pay $11 million.

In the media, we see reports about how companies aren't going to pay and instead are using backups to get back online. Those reports usually turn into the company paying the ransomware. The best way to avoid ransomware is not to be a victim. There are two ways not to be a victim of a ransomware attack:

1. Don't get attacked.
2. Have robust security in place coupled with verified backups.

The first option is out of our control. If a ransomware attacker wants to target you, there isn't much that will change that. However, you do have control over the quality of your company's computer infrastructure.

Too many companies ignore security. They have outdated security software and don't update what they have. Or, they leave large holes in their system that anyone can walkthrough. Often the weakest link is the absence of security training and best practices of company employees. These are not difficult fixes and can help prevent your company from falling victim to a ransomware attack.

What can a credit union do to protect itself? We've already outlined a few areas where companies fall short with security. Here's a quick list of what any credit union can do now to protect itself from most cyber threats, including ransomware attacks:

• Keep operating systems and applications up to date.
• Run the latest anti-virus and malware software.
• Don't allow every device to access the Internet. The more access, the higher the potential for a hack.
• Train employees on best practices for security and enforce them.
• Backup regularly and periodically verify that backups are what you think they are.
• Run network restrictions that limit specific traffic.
• Audit the system regularly, preferably using a third party trained in this practice.

Ransomware is starting to become a cost of doing business. But those who are prepared stand a better chance of not having to write off thousands or millions of dollars to get their data back.