Phishing and Ransomware attacks have become a major security concern for all types of companies, regardless of size and industry. These are sneaky attacks that have a major impact on business and can paralyze the activities of an entire company. 

In 2021, the Verizon Data Breach Investigations Report (DBIR) reported on the financial impact ransomware had on organizations, with most paying a global average of up to $1.2 million to return with their digital security. 

As ransomware attacks have become a common threat to any business, it is important that companies are prepared to protect themselves, as cybercriminals use a variety of different techniques to succeed in their crimes, from phishing to targeted campaigns.  

By following cyber protection best practices, companies can reduce the threat risk and impact of ransomware attacks by decreasing their vulnerabilities to ransomware attacks and limiting the damage by taking a strong cybersecurity stance. 

Here's what detection strategies to adopt in your company: 

Phishing protection is the first step 

Phishing emails have historically been one of the main delivery vectors for malware, and the same is true for ransomware. Phishing campaigns can use a variety of different techniques to entice end users to install and execute malware and other threats.  

Basically, ransomware can be hidden using an attachment or be delivered via a link in the email. 

Prevention occurs with the use of spam and phishing protection solutions that can help prevent malicious emails from reaching end-users' inboxes.  

The adoption of technologies such as Sender Policy Framework (SPF), used to authenticate the sender of an email, Domain Message Authentication Reporting and Conformance (DMARC), an email authentication, policy, and reporting protocol, and DomainKeys Identified Mail (DKIM), an email authentication solution, help protect against spoofed emails.  

Implementing these phishing protection best practices will help reduce one of the main causes of ransomware distribution. Another important key, is to recommend that organizations conduct security awareness training to train and educate the workforce about the risks of phishing attacks. 

Define a list of allowed applications for your business 

In addition to preventing access to malicious sites, companies should implement application permission lists, which can limit what software runs on a system.  

In practice, the IT team can explicitly allow certain applications to run, or they can specify the locations from which the applications can run. 

Often the ransomware delivered via phishing or exploit kits is located in the most accessed directories, such as the Downloads, Temp or AppData folders.  

By allowing only digitally signed or mapped as trusted applications to run, an enterprise can help block the execution of several variants of ransomware. 

Implement backups in a robust backup strategy  

The attack model implemented in digital crimes using Ransomware is based on denying an organization access to its data. Companies that pay the ransom do so in an attempt to gain access to information that is strategic to the business and resume normal operations.  

However, if an IT team can access your data, there is no need to pay the ransom and that is where backups come in. 

A robust backup strategy is a central component of a business's ransomware recovery strategy. Backups should be immutable, encrypted, and follow a 3-2-1 backup strategy.  

Companies must create multiple backups of their systems on different media types and store them in geographically distributed locations. 

Make sure your systems are being kept up-to-date with the latest security patches 

Organizations are struggling with the challenge of vulnerability management on a daily basis. It is essential to have good patch management practices that are audited regularly and randomly.  

Make sure your software vendors are keeping pace and not forcing your organization to run on an unsecured/unpatched version of an operating system. 

Protection against ransomware attacks should be a continuous improvement process 

Ransomware groups take advantage of security weaknesses to execute common attack vectors. Acting with security best practices and closing any identified security weaknesses in an organization decreases the risk of infection by cybercriminals.  

From investment in cybersecurity, strategies and tools, such as the ISH Vision MSS solution that aids in risk mitigation, a company can develop and implement a strategy that provides more robust and comprehensive security by design against ransomware and other cyber threats.