Zavelix IT Practice Tip: Ransomware Preparedness for Small Businesses

Zavelix IT Practice Tip: What this is about

This is a general practice tip, not a report on a current event. It draws on BSI information about ransomware.

In a ransomware attack, data is encrypted and release is offered only in return for a ransom. Increasingly, attackers also threaten to publish data stolen beforehand. The impact is immediate: services and business processes become unavailable and IT comes to a standstill.

Why small businesses are affected too

According to the BSI, the barrier to entry for attackers has dropped considerably because criminals work in a division of labor. An attack is now possible without much expertise or money, so large and small companies can be hit. The BSI regards ransomware as one of the biggest operational threats to cybersecurity.

The BSI believes the threat is still often underestimated. Effective, long-proven protective measures exist but are implemented too rarely. It speaks of an implementation gap rather than a lack of measures.

Preparation: what to put in place

The simplest measure, though not sufficient alone, is raising staff awareness. Typical infection paths are carelessly opened email attachments and redirects to compromised websites. Healthy skepticism online helps. The BSI also names technical and organizational measures that considerably improve protection. The source does not detail these specific measures here; it points to its own publications such as the Top 10 ransomware measures and a ransomware catalog of measures.

• Train employees regularly on email attachments and suspicious websites.
• Review the BSI Top 10 ransomware measures and the ransomware measures catalog and check what you have already implemented.
• Prioritize open items and actually implement them rather than just planning.
• Create a crisis plan covering technical recovery as well as internal and external communication.

When it happens: act quickly and carefully

Even good preparation offers no one-hundred-percent protection. The BSI advises acting quickly and thoughtfully, using suitable crisis management and involving IT security experts or service providers early. The incident should also be reported to the responsible bodies, such as the state CERT and the state data protection commissioner. Filing a complaint with the state criminal police office is also recommended.

What should companies do now?

Use these steps as a checklist for your preparation.

• Schedule awareness training for all employees.
• Compare the BSI measure lists with your current status and close gaps.
• Define an emergency and communication plan in writing.
• Clarify in advance who you will call for IT security support during an incident.
• Know your reporting channels: state CERT, data protection commissioner, state criminal police office.