Eight Best Practices to Avoid a Business Lock Out

By Harry J. Lew

As an independent financial-services professional, you’re only as good as your data . . . the knowledge in your head and the information stored on your computer. As long as you have access to these resources, you can work for anyone, from anywhere and be as successful as you wish to be. Want to move across country? Fine, just bring your brain and computer with you and hang your shingle the next day.

But it all hinges on information access. Losing your head isn’t (normally) a practical concern. But getting locked out of your computer is, especially with the mounting threat of ransomware. As we saw on May 12, 2017, when cybercriminals launched a global attack that crippled at least 200,000 computers in 150 countries, the threat of losing access to your device is is real . . . and it can severely impact your business in the short term and perhaps crash it permanently if you have no data back up.

Ransomware, of course, is a form of cybercrime that has come center stage in recent years. It enters a computer when a user opens a document attached to an e-mail or clicks on the URL of an infected site. This triggers a malware download to the local computer, which then encrypts files, folders, and hard drives. Users in the most recent attack had no inkling of trouble until they started their computers and saw the following message on their screens: “Oops, your files have been encrypted,” along with a demand for $300 in Bitcoin, a digital currency that assures anonymity. Once users pay the ransom, the cybercriminals promised to provide an encryption key, which restores access . . . allegedly.

All told, experts say the financial aftermath of this incident may reach $1 billion, making it the largest single ransomware attack in history. And it’s part of a steady growth trend, which saw more than 460,000 computers ransomed in 2016, up from more than 340,000 in 2015, according to the security firm Symantec. The number of criminal ransomware gangs also increased to 101 last year, up from just 30 in 2015. Not surprisingly, the average ransom amount has also exploded – topping $1,000 in 2016, from $294 in 2015.

Although ransom attacks initially targeted consumers, criminals have shifted their targets to businesses, since that’s where the money is, and not just to huge corporations, but also to businesses of all sizes. So if you’d like to preserve your ability to operate as an insurance professional, it’s time to take the threat of ransomware—and of all cyber-threats—seriously. What to do now? Take some common sense steps to reduce your vulnerability. Here are eight of the most important ones: 

1. Back up your data regularly. Despite constant warnings from security professionals, an alarming number of insurance professionals fail to back up their computers frequently. This means they have no choice but to comply with a ransom threat, since not doing so will result in data loss. Having a back up means you’ll be protected against theft, fire, flood, or accidental file deletion, as well. Equally important is having multiple backups—to an external disk drive, cloud services, and ideally to one drive that remains disconnected from your network and stored off site. Finally, don’t just do back ups; have a back-up strategy. This involves continuous monitoring of back-up status and testing of your procedures to make sure you’re actually able to restore your files.
2. Use anti-virus software. Yes, many experts say such tools are obsolete because they’re based on detecting ever-changing virus signatures. But at the very least, using anti-virus software will prevent your computer from succumbing to the most basic, well-known ransomware attacks.
3. Perform software updates. The recent attacks took advantage of vulnerabilities in Microsoft Windows. The U.S. spy agencies were aware of them and had built hacking tools to exploit them, which criminals stole and used to attack computers around the world. Problem was, the federal government never informed Microsoft of the vulnerability until after hackers stole their tools. Still, this does not reduce the importance of keeping all your system, application, anti-virus, and other software current. Failing to keep your computer fully patched may well be the single most common reason why ransomware infects host computers. If you allow your computer to run ancient software, you will be a sitting duck for these (and other) cyber attacks.
4. Avoid using macros. Much ransomware apparently is embedded in Microsoft Office documents. Once the document enters the system, it invokes a macro, which initiates the attack. Fortunately, Microsoft has provided an Office tool that prevents users from using macros with files downloaded from the Internet.
5. Set up your e-mail anti-spam settings. E-mail attachments that users unwittingly click are one of the primary modes of ransomware infection. To prevent this, make sure your webmail server is set up to block questionable attachments such as those with .exe, .vbs, or .scr extensions.
6. Get in the habit of not clicking on links within e-mails or opening attached files. And don’t assume that a file or link a friend sends you is harmless. Hackers frequently get access to computers for the sole purpose of e-mailing malware to all of the user’s contacts, assuming that the targets will trust the links or attachments. Don’t fall for this!
7. Always enable your system’s firewall. Without a program or device that prevents unauthorized access to your computer and/or network, hackers can have a field day with your equipment and potentially launch ransom attacks. For this reason, insurance agents should keep their Windows or Apple Firewall turned on and properly configured at all times.
8. Finally, plan for the worst. Don’t assume you’ll never become a ransomware victim. Develop a plan for how to respond to an attack; define whom to call, how to “quarantine” infected machines, where to access back-up drives, etc. If you wait until the day of an attack to plot your strategy, you will have waited too long.

In short, since your future success hinges not only your ability to deploy what’s in your brain, but also on the data stored on your computer, playing defense will preserve your ability to do business on your terms in the future. If you don’t protect the future viability of your business, who will?