top of page

Ransomware survival guide; the facts.

Updated: Mar 23, 2023

Protect your business from an expensive ransomware attack.

Unfortunately ransomware attacks have become a plague on businesses, as it is very easy for hackers to extort large sums of money. The average ransomware demand is now nearly $1M. Most businesses are not prepared for a ransomware attack and the hackers exploit the lack of preparedness. Ransomware attacks are growing exponentially and so it is not a question of ‘if’ but ‘when’ a business will be attacked with ransomware and a large sum of money extorted.

There are three steps to protecting a business from a #ransomware attack. The first step is adding security protection to the computer network, which makes it a lot harder for the hacker to access the data stored in network. The second step is continuously training employees about cybersecurity protection and attack avoidance procedures. The third step is to have a recovery plan that can be implemented quickly without paying the ransom in the case that a hacker is able to plant ransomware.

By following the points described in this document many businesses will avoid a ransomware attack. The businesses that do get attacked should be able to recover in a few hours without paying the ransom. Lets get started by understanding what ransomware is all about.

What is ransomware?

Ransomware is the name of a technique that hackers use to extort money from businesses. Ransomware requires the following steps.

  • The hacker gains access to the business server or cloud where the business application data is stored.

  • The hacker encrypts the business data so that the business no longer has access to the data.

  • The hacker sends a demand via email requesting the payment of a large number of Bitcoin to provide the key to release the data. Bitcoin payments cannot be traced or recovered.

  • The business then pays the extortion money and the hacker sends the key to release the data.

There are a few fun facts about ransomware.

  • The average ransomware demand is about $1M.

  • In 30% of cases that the business pays the extortion the hacker does not release the data.

  • Once a business has been hacked the hacker will share the vulnerability that was used to hack the network and so more hacker attacks will follow.

  • The preferred ransomware targets include education, healthcare and smaller businesses as they pay quickly. Large business and bank IT departments invest in cybersecurity as a priority and so are much harder to hack; however hackers will try so all large businesses and banks have a 24/7/365 security team monitoring attempts to hack the network and block the hacker attacks where necessary.

  • Ransomware theft is increasing exponentially as it is easy for the hacker to exploit, many tools are available, and the businesses pay quickly.

  • Most of the ransomware hackers are located in nations that are not friendly to the USA and so the hacker has no risk of getting caught; much less than 1% of hackers face prosecution.

  • Hackers do not need knowledge of programming, there are already several ransomware-as-a-service (RaaS) businesses in foreign countries that the hacker can pay to provide the hacking service, and all the hacker has to do is to extort the payment. This opens up ransomware to mafia-type organizations, which is the reason for the exponential growth with ransomware.

  • It used to be that a business manager thought that a ransomware attack could never happen. Now every business manager who has not been hacked with ransomware knows of a business that was hacked.

  • It is inevitable that a hacker will try to attack a business; the hacker’s success will depend on the precautions that the business takes now to block the hacker.

All businesses must invest in cybersecurity urgently before they become the next victim.

Business Segments that are primary targets for ransomware

Some businesses are high priority targets for hackers due to the ease of entry to databases and the fast response to pay the ransom. Market research entities such as Statista have prepared statistics regarding the business segments that are the targets for ransomware. It is important to note that many ransomware attacks are not reported because the businesses want to avoid the negative publicity regarding the exposure of customer data to hackers. The two top segments for attacks are education and healthcare.

  • Education: The education segment, especially government-funded education lacks cybersecurity protection and so is an easy target for hackers. Cybersecurity investment depends on government policy and so politicians give priority to other areas that benefit their voters. The result is that education entities, such as school boards, periodically have to make ransom payments to have student information unlocked. The cost of the ransoms paid exceeds the cost of the cybersecurity investment that should have been made. Education entities are easy money for the ransomware hackers.

  • Healthcare: Hackers prefer medium to small healthcare targets for two reasons, they are easy to hack and they pay the ransom quickly. Larger healthcare entities have IT departments and budgets to implement the HIPAA (Health Insurance Portability and Accountability Act) security rule, which specifies strict access control to patient data. Small and medium healthcare business investment priorities do not include IT and in fact there is resistance to installing greater data security because the healthcare professionals claim to need fast access to patient data and do not want to be hindered by login procedures. This is surprising because all healthcare entities have a legal obligation to comply with the HIPAA security rule, which offers a high degree of cybersecurity protection. This means that many small and medium healthcare entities are not in compliance with the HIPAA security rule. After a ransomware breach healthcare entities have a legal obligation to report the data breach to HHS (U.S. Department of Health & Human Services) and then have to pay a fine corresponding to the number of patient records that were breached. HHS publishes data breaches on their website. Until small and medium healthcare entities increase cybersecurity investments they will remain the hackers favorite money-maker.

The two segments that are least attacked by ransomware are finance and retail.

  • Finance: Financial firms such as banks have always been targets for hackers who try to get access to customer accounts. Banks especially dedicate a bigger proportion of their IT budgets to cybersecurity than other segments and this reflects in the lowest incidence of ransomware attacks. If a financial firm gets hacked it is usually to steal information and the attack makes the news.

  • Retail: Retail comes behind financial firms with few attacks. Many retail firms have on-line e-commerce, which attracts hackers. Retail firms like banks dedicate a bigger proportion of their IT budgets to cybersecurity than the industry average.

What are the methods of ransomware attack?

The hacker will try several methods to access the business servers in order to plant the ransomware encryption. Hackers refer to the methods as attack vectors.

The most obvious method is to attack the business from the Internet. If the business has no firewall installed then the hacker can exploit vulnerabilities of the router to gain access to the network. Most businesses do not upgrade the router firmware frequently if at all and so the router vulnerabilities do not get patched. If the network has a firewall that is not properly configured then it is possible for the hacker to bypass the firewall. For this reason a firewall must be installed and configured by a cybersecurity expert; simply connecting a firewall without the correct programming is not a solution that will protect the network.

If the hacker cannot access the network from the Internet the next step is to access the network end points. These are the points where users connect to the network such as the WiFi, or the point where remote users connect to the network.

When remote users connect to a network this is done through ports that are left open and so the hacker can exploit the open ports to gain access to the network. Methods of remote access must be protected. There are methods of social engineering that a hacker can use to obtain a password to gain remote access.

End-point users are the easy method of attack and most hackers will start at this point first so they don’t have to make a lot of effort. The purpose of the end point attack is to install software on the users computer that gives the attacker access to the network. Once the software, called a Trojan virus, is installed it will call the hacker and give the hacker access to that computer. The hacker then uses that computer, unknown to the user, to access the business data server.

There are many methods that hackers use to plant the Trojan virus software onto a staff computer. A few methods are listed below.

  • Identify the employee emails (usually provided on the business website) and send a fake email that appears to be from a bank or service such as Amazon, with a message that requires urgent attention “your account has just been charged” etc. with a link to click to investigate the problem. When the link is clicked the virus is installed.

  • Send an email message with an attachment that appears to be from another employee with a business document. When an attempt is made to open the attachment the virus is installed on the computer.

  • Provide a website address that is very similar to that of a supplier or customer in an email and when opened installs a virus onto the computer.

  • Send an employee a flash thumb-drive through the post without explanation. The employee may insert the thumb-drive in the computer to see what is on it, which immediately installs the virus (this works about 40% of the time).

Once the virus is installed on the employee computer it calls the hacker to advise that the attack can start. As this call is outbound it is not blocked by the firewall, firewalls are usually configured to block only inbound data traffic.

The methods employed to plant a virus on a staff computer are only limited by the creativity of the hacker. For this reason many banks and large businesses filter business emails to remove links and attachments, and provide employees with a secure method of exchanging documents. Businesses also put locks on computer USB ports to prevent a thumb-drive being inserted. It is also necessary to block access to personal email accounts on a business computer, as hackers will also use personal emails to send links. Personal emails of business staff can be obtained from web sites such as LinkedIn.

Improve the security protection of the business network

It is not possible to protect a business network 100% against ransomware hackers. Hackers constantly discover some new vulnerability in operating systems like Windows, or in application software that the businesses use. The vulnerability will allow the hacker to get access to the server or cloud and encrypt the business data then attempt to extort a payment.

Software manufacturers race to patch newly discovered vulnerabilities to block hackers, but there is always a window for the hacker to attack between discovering and patching the vulnerability. This also means that all businesses needs an ongoing maintenance contract with an IT firm to apply software patches as they are released, otherwise the window of vulnerability becomes larger which increases the risk of attack.

The hacker’s objective is to get access to the business network and then access the server database and encrypt the files. If the business uses cloud applications then the hacker needs access to the business network first. The task of getting cloud access is much harder than with network servers but can be done if the cloud service has been miss-configured.

The next figure illustrates the points where it is important that the business data processing system cybersecurity should be upgraded, if it does not have these security features already installed.

Business network data security

The features highlighted in the diagram are described in the following paragraphs.

  • A firewall between the Internet and the business network is essential. Ensure that the firewall is properly configured. A firewall without proper configuration will not block a hacker. Call an expert to have the firewall reviewed, the configuration checked, and possibly upgraded to a firewall that has more features.

  • If possible move the business applications and data to a cloud hosting service. Cloud hosting is more secure than a server located in the business network as the cloud companies invest heavily in cybersecurity. This might mean switching sales management software running on the business servers to the cloud. Software that is installed on business servers and has no cloud equivalent can be moved to a cloud service such as AWS or Azure, however this must be done by experts as it is possible to leave an entry for hackers if the cloud account is not secured correctly. Installing application software in the cloud will also benefit remote and hybrid workers.

  • Offsite backup data storage should not be on-line; files should be backed up through a VPN tunnel using an encrypted protocol. Both the network server and cloud server files should be backed up. Hackers will look to delete or encrypt backup server files before encrypting the principal data files. The backup process should not delete the previous backup files. Previous backups should remain in storage. The reason for this is that the hacker may have damaged the data file before encrypting it and so one or more of the backups may be damaged.

  • The next item is very important but overlooked by businesses. End-point security must be installed to ensure that only authorized staff has access to the network using devices that have been approved. The network end-points are the weakest link in the network security. The end-point security product is called a network access controller (NAC) and can be configured with many parameters. All user access has to pass through the end-point security. It is highly recommended to configure 2-factor authentication (2FA) to ensure the identity of the staff member. 2FA will send a code to the staff member mobile phone after entering the password; the code is then typed in to complete the authentication process. Most high-risk businesses like banks and e-commerce sites use 2FA to protect the customer information. 75% of hacker attacks are made through the network end points using a Trojan virus installed in a staff computer.

  • All user devices that connect to the network must have anti-virus software that is constantly updated with the latest patches. Some end-point security systems have active agents installed on the staff computers that permit the computer software to be checked before it is permitted to have access to the network.

  • Remote user access is a point of entry for a hacker. Remote users should connect using virtual private network (VPN) software. The firewall is configured to allow entry of the VPN connection. The VPN connection is directed to the VPN server; which then connects to the end point security. Remote staffs that connect to the network have the same authentication process as staff on-site; a 2FA code is entered after the password.

  • Experts must review the network frequently, weekly or monthly. Upgrade patches must be applied to software on all devices in the network. This includes ensuring that user computer operating system patches are applied. A known entry point that is not patched will give a hacker access to the network and lead to data theft or ransomware.

Any business that has not implemented the list of points described above is at risk of a ransomware attack. Furthermore, each business has specific weaknesses that are determined by the business model, and that might not be listed above. It is very important that a cybersecurity consultant who understands both technology and business processes is called in to evaluate all possible weaknesses.

Staff training for cybersecurity awareness

On-going staff training is necessary to ensure that all staff is aware of security procedures and the risks of a hacker attack. A business might allocate one hour each month for ‘cybersecurity awareness’ training. Many cybersecurity consultants provide this service and businesses can arrange a monthly program with the consultant. The consultant must change the format of the training each month to avoid staff boredom which may result in them skipping the training. Businesses must make training compulsory and allocate the time in staff schedules for this. It may be necessary to schedule several training sessions each month for different groups of staff.

It is very important that the cybersecurity expert understands the way that the business operates so that the potential attack vectors can be identified. A good cybersecurity expert will understand both cyber technologies and business process weaknesses.

The cybersecurity awareness staff training should include the following points.

  • Explain what a hacker attack is.

  • Explain what ransomware is.

  • Explain what damage that ransomware can do to the business.

  • Explain the additional security procedures that require extra effort on the part of the staff but will protect the business; for example the use of 2-factor authentication.

  • List the different methods that hackers will use to attack the business.

  • List the precautions that staff must follow when using business computers.

  • Provide a cybersecurity awareness document describing the procedures that staff should follow (keep it short, bullet points).

  • Provide a reporting method when a staff member identifies a possible attack.

  • Have a cybersecurity expert on call to answer questions and ensure that all staff meets the expert (ideally the expert should be the trainer).

  • Provide a reward plan for staff members that identify a potential attack.

  • Provide a reward plan for staff members that identify improvements for the cybersecurity awareness procedures.

  • Use different case studies at each training session to vary the presentation.

It is important to have staff buy-in for participation with the cybersecurity awareness training and avoid staff thinking that this is wasting their time.

Ransomware attack recovery plan

It is possible that the hacker was able to find a method to break through the security ring and lock the business software with encryption. It is necessary to have a plan in place to recover the data processing systems without paying the ransom. The plan will require the cooperation of an IT services company and cybersecurity experts to implement. The recovery plan is implemented as follows.

  • Have the IT and cybersecurity consultants on standby for the event that a hacker attack is discovered and the business data cannot be accessed. This will require keeping the IT and cybersecurity consultants on retainer to provide 24/7 support.

  • Preparation step 1: Contract with a cybersecurity expert to write an attack recovery procedure and plan a budget to have it implemented immediately.

  • Preparation step 2: backup business data daily or hourly to an offsite data storage using an encrypted transfer protocol. The backup storage must be offline and only connected during the backup process VPN. The backup storage should retain multiple historic copies of the data. Do not use online data backup, the hacker will delete or lock this before locking the primary database.

  • Preparation step 3: have multiple hard drives prepared ready to install on the servers. These should be an exact copy of the drives installed in the servers and kept up to date. Multiple copies are required because when the backup drive is installed in the server the data may get corrupted again from a source that was not identified during the security assessment.

  • The procedure that is followed after an attack is to remove the infected server hard drives and replace with the backup drives, then restore the data from the offsite backup. After the data processing system has been recovered the hacker will try to attack again using the same method of access. It will be necessary to disconnect the business network from the Internet before recovery until the cybersecurity experts have found the point of entry and blocked it. This also means that users are not permitted to access the network during this time as a user computer virus might write to the server.

  • It is necessary to test the recovery procedure at least once, and testing the procedure every quarter is preferred. If the data processing system is not used at the weekend then the IT and security team can be called in to replace the drives, recover the data and check the server logs for access reports. Problems with the recovery procedure will be found and corrected and the recovery plan updated. With practice the business recovery will be quicker and benefit the business when a real attack occurs. If the data processing system is used 24/7 then take it offline during a public holiday “for maintenance purposes”.

In the case where the data storage is on a cloud server then it will harder for the hacker to lock the database but not impossible. Weaknesses occur when cloud accounts are miss-configured. The cloud storage should be backed up hourly or daily to a cloud service or to offline storage at the installation of the IT service provider. The business has recovery options with cloud-based applications.

  • When an attack occurs create a new cloud service, reinstall the application software from a backup then repopulate the data.

  • Keep a second cloud service configured ready to be used. When the first account is hacked swap to the second account and populate using the backup data storage. As cloud services charge for use the backup service should not have a high cost until it is used.

  • As with the in-house server system, the source of the data breach must be investigated immediately and plugged quickly as the hacker will attack again using the same method.

The recovery plan is an essential part of the business IT budget. The cost of not implementing it is partial or permanent damage to the business.


By implementing the steps described in this document a business will reduce the probability of getting attacked with ransomware. The probability is not zero however as hackers are very creative and will discover new exploits that were not included in the plan. All businesses should have a cybersecurity expert make frequent security reviews, if not possible monthly then at least quarterly. Cybersecurity is an ongoing expense for a business and requires an annual budget that can be increased in the case where a new exploit is discovered and requires immediate attention. Cybersecurity is the cost of doing business in the Internet age where business administration uses computers and businesses are permanently connected to the Internet. However much a business spends on cybersecurity it will always be much less than the cost of paying a ransom. If the cybersecurity protection works really well then the business will never find out how much was saved by not getting hacked and extorted with ransomware.

For further information about our professional services please contact:


Readers are invited to share this information with others. If any reader has a question regarding this information please contact us via our contact page.

41 views0 comments


bottom of page