Avoid Ransomware: 7 Tips Your Employees Can Use Today

Ransomware is a staggering problem globally and has had a significant impact on Canadian businesses, with 61.2% of organizations surveyed dealing with the issue in some way in 2021, according to the 2020 Cyberthreat Defense Report from CyberEdge Group, LLC. While IT professionals can recommend the right combination of threat detection software and cutting-edge hardware to build layers of protection, one of your best defenses may already be in place. It is your employees. To learn why, we’ll look at what ransomware is, how it enters your systems, and 7 steps your employees can take to prevent it.

What is ransomware and how prevalent is it?

Ransomware is a form of malicious software (also known as malware), that infiltrates an organization’s or an individual’s systems and essentially makes their files inaccessible until they pay a cybercriminal a ransom to unlock them.

Ransomware is nothing new – the first documented attack happened in 1989 and targeted the healthcare industry. However, this cybercrime is on the upswing because it is relatively easy for cybercriminals to execute and profit from. Cybersecurity Ventures estimated the annual global cost of ransomware attacks to be $20 billion by the end of 2022.

Unfortunately, as awareness of the problem has grown, cybercriminals are becoming increasingly sophisticated and successful in their attacks. Their techniques are continually evolving, which makes it more likely that innocent employees will unwittingly install malware by opening malicious links or email attachments. That is how an estimated two-thirds of malware attacks happen, according to a report by DataProt. Fortunately, it is the type of attack that is most preventable through employee education and awareness.

7 Steps Your Employees Can Take Now

While your employees should never be your only line of defense, they should be your first. However, you don’t need to make them full-fledged experts on cybercrime to combat possible threats. What they do need to operate effectively is an awareness of what ransomware is, how it can penetrate systems, and what they can do personally to minimize ransomware risks.

1. Back up files. The first step shouldn’t require much effort on the part of employees if your organization has good systems in place – it’s simply backing up files regularly. These backups should be maintained off-site and offline so that a potential ransomware attack on your organization doesn’t also render your backups inoperable. The frequency of your backups will depend on the type of business your organization is in, any compliance requirements, and common sense. A call center that processes hundreds or thousands of transactions each hour will require far more frequent data backups than a printing firm that does a dozen print runs each day. Regardless of their frequency, emphasize the importance of these backups to your employees, so that they don’t forget to do them, or they don’t manually override the backup process.
2. Educate employees. Your employees are doubtless experts in their fields, but they probably are not IT experts. Because of that, you’ll want either your internal IT team or your managed service provider to stick to the basics about ransomware as they open an employee dialogue. Employees don’t need to understand the granular details of how malware works, but they do need to grasp the big picture of what an attack would do to the organization and their role in preventing it. For example, when you discuss how ransomware infects networks, discuss the phishing emails and protocol violations that often allow it to penetrate systems instead of bogging employees down with technical details of ransomware strains.
3. Teach best practices. Once they understand the severity of the threat, move on to how they can prevent it. Start with the obvious: Reinforce that they should never click on links or open attachments from unsolicited emails. While most of us have been taught not to do this in our personal lives, all too often we forget at work. That is particularly true for employees whose roles are public-facing and who are likely to receive emails from individuals whom they are unfamiliar with.
4. Empower them to make decisions. If you want your employees to be your gatekeepers, you must give them the flexibility and tools to do so. For example, if they receive a suspicious email that seems to come from a company executive, they should feel empowered enough to check with the executive in question before opening a link, sending the requested information, or carrying out any other action. The executive in question should respond positively, thanking the employee for his or her diligence rather than attacking them for not doing what was asked blindly. Creating this positive company culture will give your employees a stake in your overall security and lead to better outcomes.
5. Patch often. One of the primary ways hackers gain entry to networks is through outdated systems. Empower your in-house and/or external IT professionals to apply the latest updates and patches to all of your systems regularly. Openly discuss the importance of doing so with your employees, so that they understand why they must take time out of their workdays to allow for updates.
6. Keep them informed. Keeping employees up to date on ransomware will help them remain vigilant. When you or your team sees a news story about a new ransomware attack, share it with your employees as soon as possible. Highlight what went wrong and give them the information they need to better protect themselves – and you – from cybercriminals.
7. Encourage them to take work home. We’re not talking about traditional work. We’re advocating encouraging employees to take home and incorporate best cybersecurity practices into their personal lives. Oftentimes, ransomware attacks originate when cybercriminals gain access to an individual’s accounts. That then gives them a back door into their work accounts and potentially, access to your systems. Encourage employees to maintain best security practices – such as choosing complex passwords, not clicking on suspicious links, and being mindful of random program installation – on their devices, and particularly on any personal devices that are then brought into the office or any work devices that they take home.

Remember your employees and their actions are your primary line of defense against ransomware attacks. The more time, money, and effort you invest in their education, the more protected your systems and networks will be. Need help executing an employee education program or developing and implementing a cybersecurity plan? Contact us today!