Being held to ransom?

16 May 2017 11:31 AM

UK businesses are reportedly being forced to shut down after being held hostage by ransomware.

One report suggested that 54% of UK businesses have been targeted with a ransomware attack, prompting more than a third of them to lose revenue and many to close completely.

Here at the Information Commissioner’s Office (ICO) we want to help businesses prevent ransomware attacks, thus keeping people’s information secure and also avoiding financial and reputational damage.

Modern ransomware attacks work by infecting a host computer and encrypting files that they can locate on the hard drive. Some variants also scan the local network for files in other locations that they will then encrypt.

The attacker will then issue a ransom demand, typically for a few hundred pounds, to be paid in the digital currency Bitcoin. The sum must be paid in order to gain access to the decryption key and therefore regain access to the information stored in the files – although there is no guarantee that the attacker will release the key.

What does a ransomware attack look like?

The most well-known type of ransomware attack enters an organisation’s network as an attachment to an email. The content of the email might request the recipient take a specific action or to “act quickly” such as paying an invoice, and direct them to open the attachment. The attachment will then take advantage of any vulnerability in the operating system or other installed software (such as a word processor) and this could start the encryption process.

However, you should also be aware of other methods by which ransomware ‘payloads’ can be delivered into systems, such as via remote access and remote control applications. If the use of such an application is necessary, then you should make sure that strong credentials are used, two-factor authentication is employed where possible, and that the application itself is kept up-to-date

How does this impact on data protection?

The Data Protection Act requires data controllers to take appropriate technical and security measures to keep personal data secure against loss or destruction.

If the personal data which you are responsible for has been encrypted as a result of a ransomware attack and you are unable to restore that data then the ICO could be of the view that you have not taken appropriate measures to keep it secure and have therefore breached the Data Protection Act.

If you have a back-up from which you can restore a working copy of the data, then a permanent loss of data would not be considered to have occurred. However the ICO would still need to look at the circumstances of the case to determine whether or not there were appropriate measures in place which could have prevented the attack from succeeding.

Here are some top tips for organisations on preventing and recovering from a ransomware attack, as recommended in the ICO’s Guide to IT Security, the government’s Cyber Essentials and 10 Steps to Cyber Security. The NCA have also published guidance on this topic. The tips are also a good starting point for people wanting to protect their home systems because these can also be vulnerable to ransomware attacks.

Prevention:

• Check you have basic technical cyber protection against malware and that it is up to date
• Ensure all of your devices have the latest necessary security patches
• Remove unnecessary user accounts (such as guest and unnecessary administrator accounts) and restrict user privileges to only what is necessary
• Remove or disable unnecessary software to reduce the number of potential routes of entry available to ransomware
• Segment your network so that if an attack does take place the damage you suffer is limited
• Importantly, your back-ups need to be protected from also being encrypted – make sure you have an offline and offsite back-up
• Train your staff to recognise a ransomware attack if it does manage to get past your anti-malware protection

Recovery:

• Make sure you have an effective back-up policy and process in place and that this is working. Can you be sure the back-up will not be encrypted in the event of a successful attack?
• Make sure you can recover from a ransomware attack by testing your back-ups regularly
• Once you have removed the ransomware, ensure that you carry out a full security scan and penetration test of your systems and network – if attackers were able to get the ransomware onto your systems, they may have gained other access that you have not detected.

If you’d like advice on how to protect your home systems from a ransomware attack there’s a separate Huffington Post blog with some key tips.