Solid Backup Plan Best Defense Against Ransomware in Higher Ed
Thursday is World Backup Day, and attention across the globe is focused on how a solid storage plan can pay dividends in the event of disaster. The event, first held in 2011, is aimed at getting agencies, businesses and individuals to back up their files, as well as highlighting common ways data can be lost and options to back it up.
Recently, hackers have been profiting from crypto-ransomware attacks — an exploit that silently locks down a server's data through high-level encryption, giving hackers the keys to the digital kingdom. Backups are the first defense against such an attack; being unprepared could cost thousands of dollars.
In a March article in The Wall Street Journal, Chris Stangl with the FBI’s Cyber Division, referred to ransomware as “a prevalent, increasing threat.” Ransomware can infect data systems through a variety of vectors, but one of the more popular methods is through malware in email. A simple misplaced click can lay waste to a network’s defenses.
Higher education institutions have become particularly vulnerable to “spear phishing,” where hackers disguise malicious e-mails with text that is personalized or in some way looks legitimate, according to the Beazley Breach Insights 2016 report.
“The relatively open nature of campus IT systems, widespread use of social media by students and a lack of the restrictive controls common in many corporate settings make higher education institutions particularly vulnerable to data breaches,” according to the report.
In March, several Portland State University students fell victim to ransomware attacks after an email containing a virus was sent to hundreds of students over spring break, according to TV station KGW. One student had his computer locked down by the attack, leaving his dissertation paper inaccessible until a $600 ransom payment was received. He had no backup, so he paid the ransom, according to KGW.
How Much Can a Ransomware Attack Cost?
The FBI's Internet Crime Complaint Center (IC3) reports that these ransom fees can range from $200 to $10,000. In 2015, the FBI received 2,453 ransomware complaints, with victims paying out $24.1 million, according to the Washington Post.
"Many victims incur additional costs associated with network mitigation, network countermeasures, loss of productivity, legal fees, IT services, and/or the purchase of credit monitoring services for employees or customers," according to a June 2015 news release from IC3.
Doug Jacobson, director of Iowa State University's Information Assurance Center, wrote a column for the Des Moines Register this month, addressing ransomware and how to very simply protect against attacks on data systems.
"You should back up the data on your computer. I know everyone tells you to back up your computer, but when I ask people if they do it, about half say yes," Jacobson says.
Jacobson distinguishes types of backups: long-term data archives, for data such as irreplaceable photos; and ongoing backups through cloud-based services for everyday data.
However, Jacobson notes that certain ransomware attacks can detect backups and infect them with encryption malware as well, so it's best to store such backups in an offline device.
6 Ways to Protect Against Ransomware
The United States Computer Emergency Readiness Team lists six preventive measures to help protect systems against ransomware attacks, and secure backups top the list:
- Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
- Maintain up-to-date anti-virus software.
- Keep your operating system and software up-to-date with the latest patches.
- Do not follow unsolicited web links in email. Refer to the Security Tip Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
- Use caution when opening email attachments. For information on safely handling email attachments, see Recognizing and Avoiding Email Scams.
- Follow safe practices when browsing the web. See Good Security Habits and Safeguarding Your Data for additional details.
