Even with much of the workforce at home during the coronavirus pandemic, ransomware attacks increased by 150 percent. And while the average ransom demand stood at $170,000 last year, some hacker groups were seeking up to $2 million from victims. The cybersecurity landscape in 2021 is looking even direr, as remote workers are returning to the office in droves. Christopher Krebs, who formerly headed the Cybersecurity and Infrastructure Security Agency at the Department of Homeland Security, warned last month that the world was on the cusp of a “pandemic of a different variety.” Less than 48 hours later, the Colonial Pipeline cyberattack shut down a system that provided 45% of all fuel consumed on the East Coast. The company paid a ransom of over $4 million, which ultimately didn't help them restore its systems.
SEE ALSO: Cyber Insurance Rates Rise as Cases Grow
The takeaway? Ransomware remains a huge threat to businesses and can take down vital national infrastructure as easily as it can paralyze hospitals.
Cybersecurity has the attention of the highest levels of government. Following the Colonial Pipeline attack, the House Homeland Security Committee reintroduced the bipartisan Pipeline Security Act, which amends the 2021 National Defense Authorization Act. The act directs specific agencies across the federal government to create measures to assess and prioritize cyber and physical security vulnerabilities, threats, and defensive responses. It also designates the TSA as the lead agency for cybersecurity oversight of energy pipelines and establishes a partnership with the Cybersecurity & Infrastructure Security Agency (CISA). CISA is a major national resource, which has in the past identified the top 10 routinely exploited vulnerabilities and earlier this year took the lead in combating the Microsoft Exchange hack. Joining the fight is the National Institute of Standards and Technology (NIST), which was founded in 1901 and is now part of the U.S. Department of Commerce.
https://www.youtube.com/watch?v=2j9BGVKbzS4 NIST was established by Congress to make American industry more globally competitive, as the United Kingdom, Germany, and other European nations surged ahead in technology and research and development. As one of the nation's oldest physical science laboratories, NIST measurements support today's leading-edge technologies, from atomic clocks and computer chips to electronic health records and the electrical power grid. NIST currently runs the National Initiative for Cybersecurity Education (NICE), which organizes Cybersecurity Career Awareness Week in October. And NIST has now published an infographic with advice on how to avoid ransomware, along with a more detailed ransomware fact sheet.
To protect yourself from the threat of ransomware, NIST recommends:
SEE ALSO: Cybersecurity Risk Management: How Companies Are Responding to COVID-19 and Remote Work
"Organizations without dedicated cybersecurity professionals should consider establishing relationships with third-party cybersecurity service providers and using their expertise to assist in improving their protection against ransomware and preparing to recover from ransomware attacks," NIST notes. NIST says that to recover from a future ransom attack, you should take the following steps:
"Unfortunately, even though the recommended protective measures may be in place, a ransomware attack against your organization may still succeed," NIST says. "Organizations can prepare for this by taking steps to ensure that their information will not be corrupted or lost, and that normal operations can resume quickly." You can download the PDF of the infographic here.
NIST recommends setting your software to automatically scan emails for malware. Paubox Email Suite Premium provides robust email security, including email data loss prevention (DLP), which scans inbound attachments in a variety of formats for viruses and other threats. In addition, Paubox Email Suite enables you and your employees to send HIPAA compliant email directly to your recipients' inboxes, a vital feature for any healthcare organization.