In honor of National Cybersecurity Awareness Month, I’d like to take this opportunity to reflect on one of the hottest topics, and biggest nuisances, pertaining to IT security. I’m, of course, referring to ransomware. First, I’ll define ransomware to make sure we’re on the same page. Then I’ll share a couple of ransomware stats from my company’s own research. And lastly, I’ll describe three key ways to help ensure you never fall victim?.

What is ransomware?

Ransomware is a type of malware (i.e., malicious software) in which the data on the victim’s computer is locked, typically through encryption, and payment is demanded by the perpetrator or else the data will be permanently deleted. Payment is usually demanded through a digital currency, such as Bitcoin, so that the cybercriminal’s identity is unknown. Popular ransomware examples include WannaCry and CryptoLocker. The following is a sample pop-up that appears once ransomware has been successfully installed:

Flipping the ransomware coin… twice

Research from CyberEdge’s 2018 Cyberthreat Defense Report sheds two pieces of light on the ransomware problem. Last fall, we surveyed 1,200 IT security professionals from 17 countries and 19 industries and asked them two questions pertaining to ransomware. First, we asked if their organization had fallen victim to ransomware in the preceding year. Collectively, 55% of responding organizations were victimized. Second, we asked that if their organization decided to pay the ransom, did they get their (encrypted) data back. Only 49% of ransom payers successfully recovered their data.

So, if you think about it, dealing with ransomware is like flipping a coin twice. First, to see if your organization will fall victim to ransomware (55% chance) and, second, to see if you’ll actually get your data back if your organization decides to pay the ransom (49% chance).

Three keys to overcoming ransomware

Ransomware is often associated with phishing and spear-phishing emails. So, how can we as individuals mitigate the risks of ransomware? Here are three ways:

1. Backup, backup, backup. Whether you’re guarding your laptop for work or your home computer for personal use, a surefire way to ensure sure you don’t fall victim to ransomware is to back up your data regularly. I strongly recommend using an online backup solution that backs up your computer in near-real-time. For companies, I recommend Code42. For individuals, I recommend Carbonite – although there are dozens of viable alternatives. If your data is backed up in the cloud, then if you fall victim to ransomware, all you (or someone from your IT department) needs to do is reformat your hard disk, re-install your OS (most likely Microsoft Windows, as it’s by far the most-victimized operating system), re-install your applications, and then download your data.

As an aside, I also recommend backing up your data locally for two reasons. First, you can restore large data sets more rapidly. And, in the case of Apple Time Machine, you can restore your OS and apps, too. And second, you have additional piece of mind in case your data was unsuccessfully backed up to the cloud.

2. Think before you click. Practice common sense when clicking on links in emails and opening up email attachments. Misspelled words contained in promotional emails from well-known companies are telltale signs of a malicious email. Hover over links before clicking on them to preview the destination URL. If you receive an email from Bank of America, for example, and bankofamerica.com is not in the target URL, it’s probably a cyberattack.

3. Leverage endpoint security defenses. Although no security product is foolproof, leveraging high-quality endpoint security software will certainly reduce the risks of ransomware and other nasty types of malware. Most endpoint security products leverage threat signatures for detecting known forms of ransomware. Better products incorporate sandboxing and/or machine learning in an effort to flag never-before-seen variants.

It's fitting that National Cybersecurity Awareness Month shares the same month as Halloween because ransomware, in particular, can seem quite scary. But if you adopt these three precautions, and practice safe computing habits year-round, you’ll soon discover that—just like ghosts and goblins—ransomware is not really that scary.