Last week I talked about the problem of ransomware and how you can forever lose access to your data, unless you pay the ransom to the criminal who is extorting you.
What if you didn’t have to pay and you don’t lose access to your files? How would you like to thwart the criminal’s attempts to take advantage of you?
It is possible. But it takes preparation and periodic “maintenance.” And it has to be done properly. That is the catch. Most people fail at one of those.
What is the answer?
Back up your data.
If you have all your data available in another place, the threat of losing that data because of ransomware is no longer much of a threat. Of course, there is the inconvenience of getting your computer into a stable condition and also of replacing all that data. But, if you can do that, the criminal no longer has much leverage, as long as you are willing to take the steps to restore everything to the way it should be.
With this solution, you win in two ways. You can avoid having to pay the ransom. You also know that your computer is in a healthy state (if your backup was done before it became infected).
On the other hand, if you pay the ransom, and the criminal does restore your data to a usable state, there is still a problem. Do you trust the criminal who just took advantage of you to play honestly and fairly with you? Or did they perhaps leave some malicious software on your computer? Are they monitoring your activity? Will they repeat their crime again? There is a very good chance that your computer is no longer in a “safe” condition once it has been compromised, even though the criminal “fixed it” for you.
Let’s put it another way? If someone stole money from you, would you hire them to be your bookkeeper or your accountant?
So, you are better off having a backup and restoring your computer and data than if you rely on the criminal to fix things after you pay a ransom.
There are, however, some problems with this approach.
* Most people don’t back up their computers, even if they know it is a good idea to do so.
* Any new data added after the last backup would be “lost.” (The answer to this problem is to always back up any new data.)
* People who back up their computers and data often don’t do a good job and are unable to use their backups if they need them.
* The best way to restore after a compromise is to restore everything. Most people aren’t prepared to do this.
However, if you do have good backups and have all your important data backed up, you have everything you need and don’t have to worry about losing your data. You can refuse to pay the ransom and not worry.
Now, I’m sure many of you will see this as a major problem. You aren’t sure how to back up your computer or data. You have questions about what to back up and how to do it. And there are a lot more questions and concerns you may have.
To answer those questions and concerns, I will be creating a course on backing up your data. How soon I do that will depend in part upon the level of interest (how many people put their name on the notification list). If you are interested, you can sign up HERE. (Signing up does NOT obligate you to participate when the time comes, but does assure you will be sent notification.)
There is a second concern related to ransomware that is not nearly as common but does apply in some instances. As mentioned last week, in certain cases, the criminal will threaten to release your sensitive data to the public if you don’t pay.
There are two solutions to this problem. First, don’t keep anything sensitive on your computer. (This can be tricky, because there are sometimes traces of activity, even if you take precautions to eliminate it.)
Secondly, use encryption for any sensitive data. Best practices recommend encrypting anything you don’t want someone else to gain access to.
However, you need to use a good encryption solution and you need to do everything properly. There isn’t time to talk about that here. A lot of encryption is done poorly. However, even SOME encryption would probably be better than none. If your data are encrypted with a good solution, the criminal won’t be able to access your sensitive data. If the solution isn’t so good, it is still possible that they won’t find it worthwhile to try to break the encryption so they can blackmail you. They may go on to the next victim that hasn’t taken any precautions. (Just like a lock on the door of your house: A criminal can still break in, but if you take good security precautions on your home safety, there is a good chance they will find another victim, unless there is some reason they are really motivated to break into YOUR house.)
To review:
If you become a victim of ransomware and you can recover your computer and your data from backups, you don’t have to worry about losing access to your data. Although it may be an inconvenience, you can refuse to pay and still access your data.
If you are using a good encryption solution for sensitive data and not making mistakes in proper use of it, you are in good position to ignore any attempts to blackmail you with threats for release of that data.
To apply these solutions will require that you take measures BEFORE you become a victim. Your particular situation will determine how much effort that advance preparation will involve. You have a some choices:
* You can learn how to take those measures and apply them yourself.
* You can hire someone else to implement those measures for you. However, if you do this, I still recommend you learn at least the basics, for two reasons:
– You can make sure the person doing it is “covering all the important bases” and not missing something critical
– You will be aware of YOUR part in making sure the solution works as desired (if you make mistakes with backups, or especially with encryption, you may find that the backup or encryption fails to protect you)
* If you are in need of a solution for a particular situation, you can engage me as a consultant to work with you to discuss and/or address your particular circumstances.
Regardless of which choice makes the most sense to you, I want you to be aware of one thing: