FOS.net help small businesses build resilient cybersecurity defenses. We understand how important it is to not only protect your business but also those you look after. To help you on your journey, we have put together this guide. 

 What is Ransomware?

Ransomware is a type of malware that infects your computer, network systems, and the data held on them. The data becomes encrypted by the hacker, with access blocked until the ransom has been paid. While you might expect to regain access to your data once the ransom has been paid, there have been numerous cases where the data has not been returned. 

There are many variations and ways to distribute ransomware, however, phishing and targeted attacks are the major causes of ransomware distribution. By clicking on a suspicious link, opening an email from an unknown user, or downloading malicious files, the ransomware strain will gain direct access to the computer and data. The malware will begin to encrypt the data when malware infects the machine. 

Ransomware is malicious. It could strip your business of the ability to function, destroy your data, and cripple your funds. The need to better protect your business and those you protect has never been greater. In the following blog article, you’ll learn how to do just that. 

Add Multi-Factor Authentication to Microsoft 365, Management Tools, and SaaS apps. 

Enabling and enforcing MFA on all 365 accounts is the number one security recommendation for all small businesses. However, MFA should also be enforced by default for every web application that is used by the business without exception. Furthermore, as many small businesses outsource their I.T. to third-party support companies, such parties need to demonstrate that they enforce MFA on their Remote Monitoring and Management platforms. 

Deploy third-party Email Security protection

91% of cyber-attacks start with an email, and with over 250 million active business users now using Microsoft 365, advanced security for 365 has become a major focal point and a critical piece of the overall security puzzle. The conventional wisdom was to protect your Office 365 tenant with a dedicated third-party security solution to bolster your defenses, with individual solutions offering a range of benefits beyond Microsoft’s offerings. However, Microsoft strongly focuses on security in recent times, and now Microsoft’s security offerings provide an incredibly powerful alternative without necessarily needing to add another third-party solution into the mix. Although Microsoft Defender for Business is available at an additional cost, its merits need to weigh up against third-party offerings. 

Deploy Web Security 

Block users from accessing malicious websites by deploying a web security agent to every endpoint. This solution will block users from sites where malware, ransomware, phishing, and botnets are present. A platform such as Cisco Umbrella combines multiple security functions into one solution, so you can extend protection to devices, remote users, and distributed locations anywhere. For malware to spread it first needs to “call home” to the host site, so if we block this pathway, then we can sandbox and isolate the malware. Furthermore, Small Businesses should also consider implementing a URL filtering policy. Through URL filtering, you can limit your exposure to liability by managing access to web content based on a site’s categorization. The URL Filtering policy consists of rules that you define. When you add a rule, you specify criteria, such as URL categories, users, groups, departments, locations, and time intervals.

Lock Down your Perimeter Firewall

Protecting your perimeter firewall helps to better protect you against hackers. When you leave ports such as RDP open you become vulnerable to malicious attacks. First, you need to lock down all direct connections to Remote Desktop or similar services. If you do need to publish RDS, do so using a Remote Desktop Gateway server and protect the gateway with an SSL VPN. There is no reason to leave RDP open on the internet, if it is open, shut it down today.

Introduce a Lockout Policy

A lockout policy enables administrators to determine the time a user should remain locked out of their account. For example, if a user were to forget their password a certain number of times, the user would automatically be locked out. This enables the administrator to ensure that an attacker can’t use a dictionary or a brute-force attack to try and guess the user’s password. This process is free and takes no time at all to complete. Admins need to simply set the default lock policy on computers to 10 minutes, or a reasonable number. Leaving machines unlocked or forgetting your password will leave your machine vulnerable to cyber-attacks. Always assume hackers have the means to exploit any computer at any time and start locking your machine or setting lockout group policies.

Patch your Servers and Endpoints 

Did you know that you can have the best security software in the world, and at best it will be 75% effective if you do not patch or update your computers? As you can see, patching is not optional. When updates are released, they broadcast an operating system’s vulnerability to the world. Always make sure your machines are up-to-date and patched with the latest software as soon as the patch is released.

Disable Macros 

Macros are the input sequences used to imitate mouse actions and keyboard clicks automatically. These programmable patterns are then used to automate work and trim down the time it takes to complete tasks on programs such as Microsoft Excel and Word. Unfortunately, hackers can exploit macros, turning them into malicious viruses that will hijack machines. With so many businesses across the globe now using automated programs to complete tasks, macro attacks are dramatically increasing. You can avoid macro attacks by simply disabling them on your machine using a group policy or doing it manually. If you don’t need them, it’s better to disable them before it’s too late.

Mandate Strong Passwords

Using a strong and secure password is a vital step when it comes to better protect your data. Hackers are extremely clever. They use software to crack passwords, enabling them to crack even the toughest of passwords. Having a long and complex password full of numbers, capital letters, special characters, etc, will help your data stay protected. There are a wide variety of password generator tools available, and password managers, which will help you generate an unhackable password and keep your data safe. The more you do to protect your data, the harder it will be for hackers to gain access to it.

Restrict domain Admins

Monitoring your domain admin group is a vital step to becoming better protected. You must know who operates within this group and when he adds new users. If you add a user without permission, or without the need to be a domain admin. You will increase the risk of a security breach. Your group should have a minimum number of users possible. If a hacker already has access to your system, it won’t take them long to insert themselves as a domain admin. In doing so they will have access to every machine, across every network. Once they carry out their attack, the effects will wreak havoc. Locking down your domain admin group will stop this from happening. It’s important to get ahead of the game before the hacker even has the chance to win.

Monitor Local Admins

It is important to note that users who are local administrators can knowingly and unknowingly make changes to their system which can allow malware to infect the operating system. It is also worth noting that you won’t want to add domain user groups to the administrator group. If an attack is going to happen, doing the above will enable the attack to wreak havoc on your machines and network. Make sure you remove regular user accounts from the local administrator’s group. That includes your account. If you need administrator access, use a second login.

Educate Your Users

It is also worth noting that your employees are aware of these steps, so they can take the time to educate themselves about the importance of cybersecurity. Employees tend to be the weakest link, so getting them up to speed, and trained on the latest security software will only help strengthen your efforts. The good news is that it has never been easier to train your employees and create customized education programs. 

Have Documented IT Policies

Only 32 percent of small businesses have cybersecurity measures and formal policies in place (compared to 61 percent of large firms) Just 19 percent of small businesses provide cyber security training for staff; and small businesses are less likely than large firms to seek guidance, information, or advice on cybersecurity concerns. Whether your business is big or small, IT security breaches aren’t an ‘if’ but a ‘when’. That means your business can no longer afford not to secure itself with a policy, at the very least. 

Conclusion

FOS.net are small business experts and we have developed a standardized cyber security strategy to mitigate exposure to Ransomware. This is a multi-pronged approach that harnesses the guidance as set out in this article in conjunction with the deployment of best-of-breed security solutions such as Cisco Umbrella and Microsoft 365 Defender for Business. 

Furthermore, by adopting our guidance your small business will already have met the criteria to get Cyber Essentials Certified.