In this digital world, it doesn’t take a lot of imagination to predict just how much chaos would ensue in just about any business if control of their electronic world is ripped out of their hands by bad actors. As reported by Forbes on February 18th, that’s exactly what happened to Hollywood Presbyterian Medical Center earlier this month. On February 5th, they became victims of a ransomware attack which affected a broad range of daily activities, even forcing staff to resort to pen and paper record keeping for a while. Eventually, the hospital paid roughly $17,000 (the estimated current value of the 40 Bitcoins demanded) just to get their operations on track. The Forbes article also highlighted some scary numbers on the new “Locky” ransomware variant behind the hospital attack, reporting estimations that it is infecting over 90,000 systems a day.

Joe Caruso, founder and CEO-CTO of Global Digital Forensics (GDF), a premier national provider of cyber security solutions and digital forensics services headquartered in New York City, has seen the aftermath of ransomware attacks many times over the last couple of years. According to him, “Ransomware is probably the fastest growing malware class of today’s cyber threat landscape due to its simplicity and effectiveness. When I first heard about the hospital attack, initial reports put the ransom at around $3.5 million dollars, and you know what, it didn’t even seem farfetched. After all, lives could have hung in the balance if a hospital is involved. And you can bet that ears perked in hacker circles around the world too, getting them to think that if they hit the right target, one heavily reliant on their digital assets, the sky is the limit. Make no mistake about it, the threat from ransomware like Locky, and it's certainly not the only one, is very real and the list of victims is growing fast That’s why we offer solutions which stress the importance of regular threat assessments, testing, enterprise-wide cyber awareness training and effective incident response, because with today’s threats, if those four elements are not working in concert, your business is more than likely going to be in for a rude and costly awakening at some point.”

So how is ransomware delivered?

“As with most of today’s most malicious threats, hackers typically seek out the path of least resistance,” says Caruso, “so they rely on the most fallible aspect of any organization’s cyber security posture, the human element, with the most common way of introducing malware being through a phishing or spear phishing email with an infected attachment, or Driveby attacks launched from visited websites containing malware.”

So how can ransomware be avoided?

“In two words, vigilance and awareness. Automated antivirus and antimalware solutions can do an excellent job stopping a great majority of attacks, but they are not intelligent enough to deal with the social engineering strategies hackers use today to compromise targets. And the key to stopping threats like ransomware is to never receive the payload in the first place. Hacks that make national news, and a majority of big ones that go unreported for obvious reasons, almost always use some type of social engineering, from those phishing and spear phishing emails and Driveby attacks I mentioned, to hand delivering a payload that gets injected via an infected USB stick. Stopping the most advanced and costly threats all starts with understanding what to look for, where the weak links are and how to avoid becoming a victim. That’s what we do for clients with comprehensive cyber threat assessment with a special focus on social engineering methods used by today’s real-world hackers. We’ve done assessments, pen-testing, awareness training and served as emergency incident responders for hundreds of organizations, from companies and corporations recognized around the world, to small and medium sized business in every industry imaginable, so from A to Z, we can customize solutions and plans to fit virtually any situation and budget. We offer free initial consultations where we’ll be happy to discuss your unique needs and lay out a cost-effective plan, so there is no risk and no more excuses. The much bigger risk when it comes to cyber security is doing nothing,” warns Caruso, “because in today’s digital world, that’s a plan which could cost you everything.”

*Global Digital Forensics is a recognized industry leader in the fields of computer forensics services, electronic discovery (eDiscovery), cyber security and emergency incident response, with years of experience assisting clients in the government, banking, healthcare, education and corporate arenas. For a free consultation with a Global Digital Forensics specialist, call 1-800-868-8189 about tailoring a plan which will meet your unique needs. Emergency responders are also standing by 24/7 to handle intrusion and data breach emergencies whenever and wherever they arise. Time is critical if a cyber-incident has occurred, so don’t hesitate to get help. For more information, visit our cyber security page.