How your business can become resilient against ransomware and phishing attacks

What’s the difference between ransomware and phishing?

The terms ransomware and phishing are often used in the same breath when talking about cybercrime — yet they are two different fraud tactics used together to carry out one of the most popular cyber attacks threatening Canadian businesses today.

1. Ransomware is a form of malicious software (malware) that blocks access to a business’ data or a computer system, usually by encrypting it, until the victim pays a ransom fee. Often, the ransom demand comes with a deadline — and if the victim doesn’t pay in time, the data is gone forever. In many cases, ransomware is designed to spread across a network and quickly paralyze an entire organization.

2. Phishing, meanwhile, is the delivery mechanism of choice for ransomware and other malware. A victim of a phishing attack will receive an unsolicited email, which appears to be from a trustworthy source, encouraging them to open the message or click on a link within it. Once they do, the ransomware starts to encrypt their data.

The potential impact on your business

Ransomware can severely impact your business, including downtime, permanent data loss, intellectual property theft, privacy breaches, reputational damage and expensive recovery costs. According to the Canadian Centre for Cyber Security, the average ransomware attack cost — including payout and recovery — was $2.3 million in 2021.

How to protect your business

Protecting your business against ransomware and phishing attacks involves protection on a few different levels — first, by keeping attackers from reaching your data in the first place and second, by protecting the data itself.

Keep fraudsters out

The best way to keep fraudsters out of your systems is to implement cyber security education and awareness practices. Because phishing relies on manipulation tactics, being aware of what a phishing attack looks like – and educating your staff about the signs of a phishing email — is your first and best line of defence.

Ways you and your staff can defend against a phishing attack:

• Don’t open attachments or links in unsolicited emails.

• Never provide personal information or sensitive information – such as client names or financial data – over email. Your financial institution or other credit organization will never request such information this way.

• If a message contains spelling or grammar errors, it’s a sign the email is a scam and should be deleted before it’s even opened.

• Any suspicious emails should be reported to the business owner and/or other senior leaders in the organization.

Protect your data and systems

• Back up data. By backing up, you can restore lost or damaged files and can help ensure that your business can recover quickly and completely following a ransomware attack.

• Ensure your software is up to date. Regularly schedule scans and install updates and patches to improve security.

• Manage account access. Give administrative privilege only to those who need it in order to limit the potential exposure of your network.

• Install anti-virus software. Use software can detect and block threats automatically.

While ransomware attacks have been around for years, they’re unfortunately on the rise worldwide. Scammers today have easier, cheaper access to ransomware tools. This technology, combined with high rates of payment, makes it a lucrative activity for cybercriminals. As such, businesses must be extra vigilant and regularly continue awareness, education and data protection activities.

1 – TELUS Canadian Ransomware Study, 2021

Share This Article