If you need HELP, SUPPORT or just have a GDPR question please call +44 (0) 208 133 2545 or email us at firstname.lastname@example.org.
Alternatively please visit our contact page
FREE GDPR Helpline
Call +44 (0) 208 133 2545
Simon Rice talks about how businesses can prevent ransomware attacks.
UK businesses are reportedly being forced to shut down after being held hostage by ransomware. One report suggested that 54% of UK businesses have been targeted with a ransomware attack, prompting more than a third of them to lose revenue and many to close completely.
Here at the Information Commissioner’s Office (ICO) we want to help businesses prevent ransomware attacks, thus keeping people’s information secure and also avoiding financial and reputational damage.
Modern ransomware attacks work by infecting a host computer and encrypting files that they can locate on the hard drive. Some variants also scan the local network for files in other locations that they will then encrypt.
The attacker will then issue a ransom demand, typically for a few hundred pounds, to be paid in the digital currency Bitcoin. The sum must be paid in order to gain access to the decryption key and therefore regain access to the information stored in the files – although there is no guarantee that the attacker will release the key.
The most well-known type of ransomware attack enters an organisation’s network as an attachment to an email. The content of the email might request the recipient take a specific action or to “act quickly” such as paying an invoice, and direct them to open the attachment. The attachment will then take advantage of any vulnerability in the operating system or other installed software (such as a word processor) and this could start the encryption process.
However, you should also be aware of other methods by which ransomware ‘payloads’ can be delivered into systems, such as via remote access and remote control applications. If the use of such an application is necessary, then you should make sure that strong credentials are used, two-factor authentication is employed where possible, and that the application itself is kept up-to-date.
The Data Protection Act requires data controllers to take appropriate technical and security measures to keep personal data secure against loss or destruction.
If the personal data which you are responsible for has been encrypted as a result of a ransomware attack and you are unable to restore that data then the ICO could be of the view that you have not taken appropriate measures to keep it secure and have therefore breached the Data Protection Act.
If you have a back-up from which you can restore a working copy of the data, then a permanent loss of data would not be considered to have occurred. However the ICO would still need to look at the circumstances of the case to determine whether or not there were appropriate measures in place which could have prevented the attack from succeeding.
Here are some top tips for organisations on preventing and recovering from a ransomware attack, as recommended in the ICO’s Guide to IT Security, the government’s Cyber Essentials and 10 Steps to Cyber Security. The NCA have also published guidance on this topic. The tips are also a good starting point for people wanting to protect their home systems because these can also be vulnerable to ransomware attacks.
If you’d like advice on how to protect your home systems from a ransomware attack there’s a separate Huffington Post blog with some key tips.
Simon Rice is the Group Manager for the Technology team which provides technical expertise to all ICO departments in order to support the broad range of activities undertaken by the ICO.