7 Steps to Avoid Ransomware in New Jersey

Cybersecurity in New Jersey Comes into Focus in 2019

• New Jersey Hospital System Hit By Cyberattack
• Ransomware Attacks New Jersey’s Livingston Public Schools
• Shakespeare Theatre in Madison Hit By Ransomware Attack

The last two months of 2019 were rough for cybersecurity in New Jersey, with high-profile attacks significantly harming major businesses and causing them to cancel surgeries, delay school openings, cancel performances, and more.

But unfortunately, that’s far from unique. The FBI ranks New Jersey ninth in the country for cybercrime losses, with more than 8,400 victims across the state incurring $79.7 million in related costs in 2018. Govtech reports that dozens of municipal government agencies in New Jersey have been attacked over the past two years but have been reluctant to make those attacks public.

Many of those attacks included ransomware – hackers breaking into systems, encrypting the data, and releasing it only if the organization pays a steep fine. Many organizations are paying the ransoms because they see this as the fastest way to get their businesses back. But not everyone recovers their data, and even when they do, it often takes months to fully restore operations. Preventing cyberattacks such as ransomware is critical to avoid becoming the next target.

Experiencing a Hack

The insidious nature of ransomware means organizations can go weeks or months without knowing they were attacked. It starts simply, often when a user responds to a phishing attempt, opens an attachment to a spoofed email from a trusted source, or falls for other trickery. Clicking on the wrong link allows malicious code to be embedded somewhere in the system, often replicating itself in many places in the event the foreign code is discovered. That code connects the system to the hacker’s server so they can control what happens from afar.

Then one day the hacker activates the code, encrypting all the data it can reach in the network – work documents, database files, spreadsheets, and email. Files might start mysteriously getting new names, or applications start to crash.  The attack also includes an instruction document laying out the terms of the ransom demand. Some even offer support lines to help victims comply and hopefully, furnish the decryption key after the ransom is paid. Even after that, malicious code may remain in the system.

Preventing Ransomware

No one wants this. Every organization needs a solid multi-layer security stance to start. Here’s what else to do to reduce the likelihood of an attack:

• Avoid legacy operating systems and keep up with patches.
• Train users on how to recognize suspicious emails and use good digital practices. For example, telling them to hover over links that are embedded and see if they match a site that’s related to the email.
• Avoid unencrypted methods of communication, especially when there are passwords or credentials in the content. Use a VPN to connect from offsite. Consider two-factor authentication.
• Make sure administrators are not using administrator accounts to log into networks for their day-to-day business.
• Back up your data using cloud-based systems that store daily snapshots of data. After an attack, that enables you to reset systems back to a date before the attack began, to avoid restoring an infected environment.
• Buy cyber insurance – and know what it covers. The costs of recovery can be many times the actual ransom cost.
• Leverage cybersecurity expertise. Most of New Jersey’s schools, hospitals, non-profits, and other businesses aren’t in the IT business. Even with talented staff, most can’t match the expertise or 24/7 vigilance of a dedicated IT organization.

Exigent starts its IT security services with a thorough audit of your network including penetration and other testing and recommends solutions to fill the gaps. Then we put tools in place to alert our experts to suspicious activity to prevent or minimize the impact. We can also help you create a solid disaster recovery plan, including making required notifications to meet compliance standards.

Ransomware is everywhere, and cybersecurity in New Jersey came into big focus in 2019.  But when it starts impacting your neighbor’s surgery, your son’s school day, or your ability to run your business, it feels very local. Reach out today to find out how you can avoid being featured in tomorrow’s New Jersey cyberattack headlines.