The average downtime from ransomware attacks can be almost a month, leading to lost revenue, decreased productivity, delays and overtime. Luckily, there are ways to prepare for a cyberattack so you can quickly recover. Here’s how organizations and individuals can prevent costly hacks and what they can do if the worst occurs.
Risks and Average Downtime From Ransomware
Ransomware wreaks havoc on victims’ networks. It can destroy valuable data and lead to a prolonged and expensive recovery without the right preparation beforehand. Research shows the average downtime from ransomware ranges from 15 to 26 days, although it can be longer than that.
During this downtime, productivity is severely reduced, data and hardware are at risk, and overtime pay is often necessary. The longer the problem lasts, the more exposed the network is, and the more expensive recovery becomes.
The hacker retains control as long as an organization’s network remains offline. During this period, cybercriminals attempt to scare victims into paying their hefty ransom fees, but organizations should never do this. Paying ransoms only encourages criminals and there’s no guarantee they will keep their word.
Additionally, downtime leaves compromised data vulnerable to exploitation. The hacker can do whatever they want with stolen information as long as they can access it. They may even attempt another attack while their victim’s network remains vulnerable.
5 Tips for Preventing Downtime
The risks and average downtime from ransomware are concerning, but you can take action to prevent it. International law may require some organizations to ensure they have robust data security protections in place. Companies can implement these five key tactics to avoid lost productivity and save money when recovering from a cyberattack.
1. Conduct Frequent, Reliable Backups
Backing up your data is the No. 1 strategy for minimizing downtime after a cyberattack. The messiest recoveries are usually due to a lack of recent backups to restore the network. This situation can significantly increase the time it takes to bounce back after a cyber incident.
The quality and location of your backups matter. Storing a copy of a handful of key files and apps on a USB thumb drive does not qualify as a reliable backup. Choose cloud storage or an off-site server in a safe location and copy your network data and operating system. You should also be able to do this independently from the backup server.
It is also a good idea to set a regular schedule for updating your backups. It can be as frequent as once a week, but monthly is often enough.
2. Invest in a Backup Power Source
Considering the average downtime from ransomware can be up to a month or more, it’s no surprise that recovering from a cyberattack can be expensive. However, many organizations aren’t aware of the various costs that can skyrocket due to downtime.
About 82% of companies have experienced unexpected downtime for various reasons, leading to delays, overtime pay, software issues and hardware failures. This can increase lost revenue in the aftermath of a cyberattack.
A power outage can extend downtime. Hackers can corrupt your facility’s systems to shut off access to electricity, creating major vulnerabilities that compromise the entire network. Installing a backup energy source at your facility can prevent situations like this. This system is also extremely useful in scenarios like storms or natural disasters where power is disrupted for nonmalicious reasons.
3. Always Install a Clean OS
Installing a clean copy of your operating system before reinstalling all your recovered data and software from backups is always a good idea. Various types of malware and ransomware can survive deep in the OS, where they are hard to detect.
You can end up well over the average downtime from ransomware if you must recover your data again due to malware in the OS. One of the first steps in your data recovery process should be deleting your existing system and setting up a fresh copy from a known clean hard drive or backup.
4. Copy and Quarantine the Corrupted System
It might sound counterproductive to save a copy of corrupted data impacted by a cyberattack. However, this data can provide invaluable information and evidence about what happened.
Saving a copy before deleting it allows your team to conduct a forensic analysis of the data to prevent similar attacks in the future and identify vulnerabilities. Additionally, if something goes wrong during recovery, the corrupted copy can act as a source to re-recover the information.
5. Use an Overlay Network
It’s worth considering implementing an overlay network or software-defined networking strategy. This may take more time to assemble and roll out than other strategies, but it can be highly advantageous during a cyberattack, particularly ransomware.
An overlay network acts as a virtual mask on top of your network’s physical infrastructure. Consider it a decoy of the actual infrastructure it’s running on. Many different types have everyday benefits, like easy segmentation.
An overlay can shield your physical network infrastructure from malware or ransomware during a cyberattack. You can set up an overlay that stores all your data, much like a save state. If the system is compromised, a few clicks can delete the corrupted version and recover the clean save state of your information and OS.
Ensuring a Quick Recovery From Ransomware
It’s important to be aware of the risks and average downtime from ransomware so you can take steps to prevent a worst-case scenario. Poorly prepared organizations can face the repercussions for a month or more, leading to high recovery costs.
Implementing a handful of defensive strategies can prevent this kind of expensive downtime and set yourself up for a swift recovery after a cyber incident.
