How do I stop Ransomware? (Level 1)

How do I stop Ransomware? Preventing Ransomware is a complicated endeavour.  As mentioned before, the most common method of becoming a victim of ransomware is opening a file that is designed to look like something you want to open, or clicking on a link on a website, again designed to get you to click.  User education is going to be the best solution to prevent Ransomware.  Unfortunately, this is also the most difficult.   Ransomware Prevention Checklist: Use a quality Firewall (I know a guy) Make sure that Firewall is configured correctly by a security expert (I know a guy) Keep all software up-to-date Treat email attachments from people you don’t know as hostile Stick to websites that you need for business. Don’t follow the clickbait Share this with your coworkers The security world is a lot like a chess game, the bad guys find the holes, the good guys build the fixes. There is a software solution right now that is designed to prevent a Ransomware attack and halt the process.  It’s at a decent price point as well, especially if you look at the cost of either paying the ransom (don’t do it!) or attempting to recover from backups and the loss of revenue/time in that process. 2016-12-18 MDux

It's official - Winter is coming.

As the first storm rolls into the Pacific Northwest, this is a great reminder to us to check our Disaster Recovery / Business Continuity Plans.

When is the last time the plan was revised?
When is the last time the plan was tested?
Do you know how many hours/days’ worth of data you have at risk?
Do you know how long it takes to recover data?
Do you know the cost per day of disruption?
Are you storing data on multiple media formats?
Are you taking backups of site, either physically or digitally?
                           
Key Terms to know:
RPO - Recovery Point Objective
How much data can be lost - worst case scenario.

i.e. If you perform a full back up on Thursday night, and an incremental on Tuesday night: If a disaster happens right before the backup on Tuesday, all data from Friday, Monday and Tuesday is at risk. Alternatively, if a disaster happens right before the full on Thursday, all data from Wednesday and Thursday is at risk. The RPO in this scenario is 3 or 2 days.

RTO - Recovery Time Objective
How long does it take to actually recover the data? Remember that recovering from an incremental might include a recovery from the last full AND the incremental.

MTPoD - Maximum Tolerable Period of Disruption
Adding the longest RPO and RTO is your MTPoD.  Hopefully, this would be the longest period of time that business would be at a dead stop.
             

I say if you have it, you won't need it, but if you don't have it, you'll need it.


2016-10-13
MDux