Ransomware hit the headlines again last week. This time it was WannaCry, WannaCrypt0r. All the general info was in the media reports – it will lock up your files, you’ll be prompted to make a payment for access, by Bitcoin of course, and “you are advised not to pay the ransom”. So that’s that. Or is it? Many business owners are left wondering: “What do I need to do?” With an after-though of “And just what is Bitcoin?”
Despite a few doomsday opinions on the matter, it can be mostly minor or a disaster. On the one hand, if you’re using proper, robust IT procedures (such as making backups, keeping your systems up-to-date, and so on,) the situation is fairly simple and more than likely, not all that critical for you. If on the other hand, your business is a bit on the sloppy side where IT housekeeping is concerned, then this has the potential to be disastrous for you.
“What you need to do” therefore, should be fairly obvious – simply get your IT house in order; engage in best practice IT security and maintenance procedures and the rest will take care of itself.
From the technical side what was different this time, was just how slow the important technical details became available. It was a bit different in some respects, but from a business owner’s perspective the concerns are the same.
Taking a broader view of the concerns raised by this latest attack, and it by no means ends with that attack as there are already further similar attacks already ongoing, there are things to consider:
- Firstly, are your procedures in place? If it’s not written down it’s not going to be consistent – that leaves room for mistakes that your business can’t afford.
- Are your procedures being followed? All too often we see a procedure written, but the practice doesn’t match the document. That should tell you there’s something wrong – either the document or the practice. Fix it.
- Is your infrastructure what it should be – for example, are you using robust hardware and software to handle your critical data? Or are you skimping on anti-virus and holding on to old hardware to avoid the cost of upgrades? If so, should you be upgrading your on-site hardware or moving towards cloud solutions? There are so many pieces to consider but get a discussion going to help you make a plan – don’t wait till it’s too late.
- Are you storing your data in the cloud? Maybe even running your applications in the cloud? In many cases we prefer this solution, not just because it’s our core business, but because it makes it so much easier for us to ensure the client’s systems and information are properly maintained, secured and functioning. It does however bring a different set of considerations – your infrastructure concerns should be considerably less, but you still need backup procedures so that your own on-site systems work, and most importantly you need to ensure your cloud service provider has robust procedures, and they follow them.
So what first? Ensure your IT support, whether it’s internal or outsourced, is knowledgeable and reliable – saving a bit on support won’t matter when you can’t recover your data. Ask questions about your backups, data security, and whether your systems are all up-to-date. And finally, start those discussions you might have been putting on the long finger, because there isn’t really a middle ground with this – you’re either prepared and it’s mostly minor, or you’re not prepared and it’s a disaster.
Does all the above mean you’ll never be affected? Of course not, but it does mean the impact is minimised if/when it does happen.
Chris Toner