Ransomware attacks have dramatically increased over the last several years. Unfortunately, they are evolving from a simple ransom, to ransom plus threat of disclosure, and using captured information to commit additional fraud. This E-Focus is the first of four articles we will present on Ransomware Readiness – this article is focused on protection and prevention.

The best way to protect an organization from ransomware is to stop the attack before it can infect any systems. Easier said than done, but with the right combination of people, process, and technology the likelihood of a successful infection can be dramatically reduced. The critical items we recommend focusing on include:

• Multifactor Authentication – protecting your email, remote access and all administrator access with multifactor authentication drastically (over 90%) reduces the likelihood of a successful attack. 
• Email Security – use the best practices for your email solution (e.g., Office365, Google, Exchange, etc.) to cut down on spam and spoofed emails (e.g., SPF, DKIM, and DMARC), require multifactor authentication, and disable legacy authentication methods.  Many cloud solutions now offer advanced filtering and anti-malware detection; these should be considered as part of the overall proactive controls strategy.
• Security Awareness Training – make the people in your environment human firewalls by training them and encouraging reporting. Adapted to each organization's culture, consider gamifying the training to make it more interesting, engaging, and fun. 
• Network Security – if ransomware sneaks through, it will eventually make contact with its command and control server for instructions. Network security controls, such as firewall rules, can prevent the ransomware from receiving “activate” instructions. Network security tools can also alert IT about the event.

Every protective technology can eventually be circumvented, so throughout these articles we will focus on layers to protect, detect, and recover. Similarly, every environment is different, so the specific technology solutions and processes will vary and need to be carefully considered for each environment.

As always, if you need information or assistance with cyber security, please feel free to contact the RubinBrown’s Cyber Security teams at any time.

^{Readers should not act upon information presented without individual professional consultation.}

^{Any federal tax advice contained in this communication (including any attachments): (i) is intended for your use only; (ii) is based on the accuracy and completeness of the facts you have provided us; and (iii) may not be relied upon to avoid penalties.}