5 Steps to Recover from a Ransomware Attack

31 May 2022

Ransomware is a type of cyberattack often used against companies of all sizes. Once the malware that this type of attack uses is downloaded to the victims' device, it seeks out and holds corporate data hostage. It does this by locking you out or encrypting the data so that it is indecipherable. Your organisation then must pay a ransom to restore your access – hence the name.

With threat researchers at SonicWall Capture Labs finding that there was a record-breaking 495.1 million ransomware attacks in 2021, this 148% year-on-year increase over 2020 means that last year was the most costly and dangerous year on record for organisations across the globe. And with ransomware demands surging by a staggering 518% in just the first half of 2021, that represents a major threat to any business.

But Veeam believes that the best offence is a good defense, and their 2021 Ransomware Retrospective report has the data to back this up. The study, designed to understand the impact of ransomware on the global IT community and its customers, found that an impressive 92% of Veeam customers didn’t have to pay any ransom to restore their data.

And recovering from a ransomware attack cost 85% of Veeam customers polled less than US$25,000 overall. With measurable data like this, it just goes to show how valuable having an effective backup process is. Having secure, timely and reliable backups for your corporate data is crucial, but it’s only part of an effective Ransomware Recovery Plan.

Read on to find out our 5 steps to recovering from a ransomware attack.

What Are the 5 Steps?

Step 1: Have a Comprehensive Cybersecurity Incident Response Plan (CIRP) in Place

While the hope is always that you will never have to deal with a cyber-attack of any kind, an attack takes place every 39 seconds. And so, while it may seem like an odd thing to have in a ransomware recovery plan, your first step should be ensuring you have a detailed cybersecurity strategy that is comprised of three main layers.

The first, of course, is protecting yourself from an attack in the first place. The second layer is a comprehensive Cybersecurity Incident Response Plan – a strategy that lays out exactly what your staff should do when an attack is in progress. The main goal with your CIRP is to mitigate the damage that a cyberattack can cause as well as help begin your recovery process.

This recovery phase is the third layer of your cybersecurity strategy and arguably the most important in terms of the actual cost of an attack. The reason is the longer it takes to restore your data and get your systems back online, the more it impacts your bottom line.

Step 2: Implement Backup Plans for All Your Corporate Data

With digital workspaces and a remote workforce becoming the norm for the modern workplace, many companies have made the switch to using the powerful services offered by Microsoft Office 365. But while Microsoft has resilience at the heart of these tools, something they don’t offer is a comprehensive backup solution.

And yet many overlook this shortfall, with 81% of IT professionals saying that they have experienced data loss in Office 365. When you consider that companies are storing as much as 60% of their sensitive data in cloud-based Office documents – 75% of which isn’t currently backed up – that is a worrying statistic. And so, your second step should be deploying solutions like Cirrus across your organisation.

Step 3: Understand the New Ransomware Incident Reporting Regime

While many industries have regulations regarding the reporting of any kind of cyberattack, proposed new legislation from the Australian government will make reporting ransomware attacks mandatory. According to this plan, any business with a turnover of more than $10 million per year will have to submit a report to the Australian Cyber Security Center or face possible civil penalties.

Step 4: Undertake Security Awareness Training for Your Employees

Your employees are the weakest link in your cybersecurity strategy. And despite 90% of organisations claiming that their employees have undergone phishing awareness training, a report by the Office of the Australian Information Commissioner (OAIC) reports that data breaches as a result of human error are up by 18%. And many successful cyberattacks on organisations start with phishing emails.

Step 5: Test Your Ransomware Recovery Plan

Many ideas and plans are great on paper but tend to fall apart when it comes to execution. Nowhere is this more true than with cybersecurity. Business is evolving every day, and the cyber threat landscape is evolving right along with it.

If you’re not testing your entire cybersecurity strategy regularly, including your ransomware recovery plan, you will never know if there are interdependencies, gaps and areas that need improvement. Cyberattacks can take any number of forms, and your ransomware recovery plan needs to be agile enough to respond to whatever that may be.