Coronavirus (COVID-19) has proven to be challenging. For most of the US, this epidemic has been ongoing for near 9 months with a new wave overtaking the country once again. Businesses have shuttered, jobs have been lost, and financial insecurity has become an obstacle for many to deal with.
As one of the ongoing complexities, COVID-19 has shuttered in-school learning for many US students. Several US school districts including Baltimore County, MD announced that online learning had been impacted for 115,000 students due to an apparent Ransomware attack. As parents struggle to maintain a somewhat normal learning experience for their children studying from home, lacking information security practices within the information infrastructures are paramount in these disruptions.
So what is ransomeware and how does this impact a compromised organization? Ransomeware is malicious software designed to deny access to an organizations information assets, files and or services. The perpetrator having compromised the target organization demands a ransom payment prior to restoring access to the locked data. In the case of Baltimore County, it has been reported that access to online learning tools and grading systems have been disrupted.
Cyber insurance policies are available to facilitate ransom payments should such an attack occur within an insured’s environment. Many organizations choose to pay the ransom through insurance or directly if not insured. The cost of ransom payments have risen with many payments now being 6 figures or larger. Other organizations that choose not to pay a ransom spend millions trying to restore systems. Atlanta Georgia in the spring of 2018 chose not to pay a ransom of $52,000 and instead paid a reported $2.6M to recover.
While an insurance policy payment may reduce the recovery cost of an outage it does not account for the lost time of a disruption and only encourages further ransomware attacks. Ransomware attacks accounted for 41% of policyholder claims, insurer Coalition stated in its 2020 “Cyber Insurance Claims Report,” released in September of 2020. In some instances insurance companies have denied claims with excessive damage as in the case of NotPetya.
According to a Dark Reading article Maryland State auditors found a variety of vulnerabilities that could have lead to the incident in Baltimore County. While there is not clarity yet in the Baltimore County incident, it should be noted that ransomeware attacks have been ongoing for many years and most propagate due to unpatched systems. Typically, exploited systems are Windows based. Impacted systems in the case of Baltimore County have been reported to be Windows based.
At what point do we demand that organizations who maintain our personal information and upon which we rely on make certain that vulnerabilities are minimized? Individuals that are placed in technical roles must be held accountable in some manner as well as their management teams should they choose not to appropriately address ongoing maintenance of the systems and applications for which they are responsible.
The most formidable defense against most cyber attacks beyond a properly designed infrastructure, is to establish reliable ongoing patch management and update processes for the entire infrastructure. While some may have you believe that this is a complex endeavor and perhaps it is in a very large scale environment, once established the organization’s ability to withstand cyber attacks is significantly improved. Choosing not to establish the proper protocols either through in-house staff or consulting resources is a dire mistake.
Network Management Solutions has been assisting organizations to properly design, implement, monitor and manage information technology infrastructure since 1996. We are available to assist your company in navigating the technical complexities associated with your business infrastructure. Call us today at 908-232-0100 for a free, confidential discussion on how we can assist your business and support your ongoing information security and technology goals.