December 19, 2016

UK businesses are reportedly being forced to shut down after being held hostage by ransomware.

The ICO explains that modern ransomware attacks work by infecting a host computer and encrypting files that they can locate on the hard drive. Some variants also scan the local network for files in other locations that they will then encrypt.

The attacker will then issue a ransom demand, typically for a few hundred pounds, to be paid in the digital currency Bitcoin. The sum must be paid in order to gain access to the decryption key and therefore regain access to the information stored in the files, although there is no guarantee that the attacker will release the key.

The ICO explains that the most well known type of ransomware attack enters an organisation’s network as an attachment to an email. The content of the email might request the recipient to take a specific action or to “act quickly” such as paying an invoice, and direct them to open the attachment. The attachment will then take advantage of any vulnerability in the operating system or other installed software (such as a word processor) and this could start the encryption process.

However, there are also other methods by which ransomware “payloads” can be delivered into systems, such as via remote access and remote control applications. If the use of such an application is necessary, then the ICO advises ensuring that strong credentials are used, two-factor authentication is employed where possible, and that the application itself is kept up-to-date

The Data Protection Act requires data controllers to take appropriate technical and security measures to keep personal data secure against loss or destruction. If the personal data for which an organisation is responsible has been encrypted as a result of a ransomware attack and that data cannot be restored then the ICO could take the view that appropriate measures have not been taken to keep it secure and the Act has been breached.

If there is a back-up from which a working copy of the data can be restored, then a permanent loss of data would not be considered to have occurred. However, the ICO would still need to look at the circumstances of the case to determine whether or not there were appropriate measures in place which could have prevented the attack from succeeding.

Tips to prevent an attack:

• check you have basic technical cyber protection against malware and that it is up to date;
• ensure all of your devices have the latest necessary security patches;
• remove unnecessary user accounts (such as guest and unnecessary administrator accounts) and restrict user privileges to only what is necessary;
• remove or disable unnecessary software to reduce the number of potential routes of entry available to ransomware;
• segment your network so that if an attack does take place the damage you suffer is limited;
• ensure your back-ups are protected from being encrypted and make sure you have an offline and offsite back-up; and
• train your staff to recognise a ransomware attack if it does manage to get past your anti-malware protection.

Tips on recovery:

• make sure you have an effective back-up policy and process in place and that it is working. Ensure that the back-up will not be encrypted in the event of a successful attack;
• make sure you can recover from a ransomware attack by testing your back-ups regularly; and
• once you have removed the ransomware, ensure that you carry out a full security scan and penetration test of your systems and network. If attackers were able to get the ransomware onto your systems, they may have gained other access that you have not detected.

To read the full blog post on the ICO website, click here.