The zombie apocalypse is frequently mentioned in literature and pop culture. Some have even taken steps to protect against this fictitious threat. However, there is a threat that is much more likely and very devastating to businesses and individuals alike. I am referring to the encryption apocalypse caused by ransomware. Just as zombies turn intelligent humans into mindless beings driven by instinct, ransomware threatens to turn our valuable data into an unintelligible collection of bits and bytes.
Ransomware is a concern for more executives, especially after the large number of ransomware attacks that took place in 2017. However, tools and techniques are available to survive the encryption apocalypse, and they can be divided into five main sections; data protection, cyber hygiene, training, incident response, and governance.
Data Protection
Ransomware targets important organizational data, so the first step in surviving the encryption apocalypse is to ensure that essential data is backed up. Organizations should conduct a thorough review of the data that exists on their systems, clouds, and BYOD devices and whether that data is present elsewhere. Next, determine which information is valuable and ensure that it is included in backup solutions.
Once a company identifies its data and configures backups for it, those backups must be tested. Restore testing is a process where data is restored and validated. Companies typically choose a sample set of data that is representative of the data types and system types. This data is then restored, and metrics are tracked to determine how much time it takes to perform the restoration. The restored data is then validated for data integrity and usability. Restore testing can identify problems with the backup solution, such as lengthy restore processes, corrupt data, or additional processes that are required to make the data available or usable by end users. Such problems should be resolved promptly so that the company can have assurance of its backups when an incident happens.
Third, data protection solutions should involve a level of segmentation from the production systems. For example, data on a network may be archived to a local backup server, but then this data is replicated to the cloud or stored on backup tapes. This segmentation prevents ransomware from affecting both the production systems and the backups at the same time.