How small business can protect themselves against cyber attacks

Contact

May 15, 2017

How small business can protect themselves against cyber attacks

Three Australian businesses have been affected by the global ransomware attacks that hit 200,000 victims in 150 countries on the weekend. What can you do to protect yourself and your business?

Image Blogtrepreneur via Flickr Creative Commons

Three ransomware attacks have been been reported in Australia this morning, after 200,000 attacks were recorded in 150 countries on the weekend.

Despite reports a domain name was registered that acted as a “kill switch” to the ransomware, reports of new attacks are still coming in.

Assistant Minister for cyber-security Dan Tehan told ABC news there is the possibility of more attacks, and the attacks in Australia are following the same pattern as the attacks overseas.

"What we are seeing is the exact same features that have occurred overseas: a freezing of their IT systems and a ransomware note."

Mr Tehan said the attacks were on small to medium-sized private sector businesses.

What happens in a ransomware attack?

Gordon Archibald, Partner, Cyber KPMG, and Stan Gallo, Partner Forensic KPMG, have written in a blog this morning about the attacks. They write the typical formula of a ransomware attack is as follows.

All data is locked on a computer system.
The ransomware provides instructions on what to do next, which includes a demand of ransom, often around US$300 (around $400).
The ransom is usually requested to be paid in bitcoins.
The ransom must be paid in a defined period, or the demand increases, eventually leading to complete destruction of data.
The encryption is carried with RSA-2048 encryption which makes decryption almost impossible.
The attackers are generally not after the information; they are after the ransom.
Bitcoin is known for its anonymity, and may present a challenge to access in Australia.
The weekend attacks involve ransomware called ‘WCry’, also referred to as WNCry, WannaCry, WanaCrypt0r or Wana Decrypt0r.
The software spreads rapidly.
The software exploits a weakness in unpatched versions of Microsoft Windows.

What can you do to protect yourself and your business?

Act quickly.
Make sure staff are aware of the risk.
Patch all systems before beginning business.
In particular, use the Windows patch released in March 2017 as part of MS17-010 / CVE-2017-01
Don't open emails from unknown sources.
Be wary of unsolicited emails that demand immediate action.
Do not click on links or download email attachments sent from unknown users or which seem suspicious.
Report all incidents immediately.

"These attacks happen quickly and unexpectedly," warns the KPMG blog.

What to do in future