The May 2021 ransomware attack on Colonial Pipeline was a harsh reminder for corporations of how easily the dominos can fall within an organization without adequate cybersecurity measures.

When the hacking group DarkSide took control of the company’s business networks, Colonial pre-emptively shut down its fuel pipeline to ensure the hackers’ access couldn’t spread. In the end, the hack caused short-lived panic at the pumps and cost Colonial 75 Bitcoin, valued at roughly $5 million.

“This attack has exposed just how poor our resilience is,” Kiersten E. Todt, the managing director of the nonprofit Cyber Readiness Institute, told the New York Times. “We are overthinking the threat, when we’re still not doing the bare basics to secure our critical infrastructure.”

For most companies, a ransomware attack may not have the same far-reaching effects, but no one wants to have to pay to access their own systems. As Todt points out, every company should ensure they have the basics covered when it comes to securing their own networks.

Start with policy

Many ransomware attacks gain a foothold in the organization through phishing. They sometimes can be perpetrated through a generic email, but more often, spear phishing is used to target individuals or groups of people with more specific, and therefore more legitimate-sounding, emails.

The first step to squashing attacks is to review the policies you currently have in place. Tech Orchard consults with businesses on policies and best practices for keeping your data safe. We can recommend updates and new ideas that help secure your network from external threats.

It’s not enough to create and update tech policies. Training employees on what to do and what not to do is necessary to keep them from unwittingly exposing the network, whether through a phishing scheme, an unsecured home network or other threats.

>> LEARN MORE: Educate employees about online best practices

Institute cyber hygiene

Employees are an important piece of the puzzle when it comes to deterring ransomware attacks, but there are other steps your IT team should be taking to reduce your company’s risks:

  • Hardening and patching: Keep systems up to date and consistently maintained. Any critical system that is out of date is a meaningful security risk.
  • Multi-factor authentication: Verify users and system components using multiple factors (not just simple passwords) and according to the risk associated with the requested access or function.
  • Least privilege: Allow users only the minimum necessary access to perform their job — nothing more. System components should be allowed only the minimum function required.
  • Micro-segmentation: Divide the whole IT environment into smaller parts to make it more manageable to protect and contain the damage if one part is compromised.
  • Encryption: Encrypt all data, whether stored or transmitted. In the event of a data breach, critical files should only result in unusable data.

Tech Orchard can recommend solutions that keep your company’s IT secure. Reach out to sales@techorchard.com for help crafting a tailored plan.