Healthcare ransomware infections have made the headlines in recent weeks, although the University of Calgary ransomware attack shows that no organization is immune: In fact, university ransomware attacks are on the rise.
Organizations in the healthcare and financial sectors are the main targets for cybercriminals, although education is the third most likely industry to be attacked. Universities store huge volumes of highly sensitive data and state-sponsored hacking groups frequently conduct attacks.
Foreign governments are keen to obtain research data and ransomware attacks on universities may just be a smokescreen. All too often DDoS attacks are performed for this purpose, yet ransomware can be just as effective. While IT departments scramble to secure systems and recover data, attackers may be plundering data.
University of Calgary Ransomware Attack: $20K Paid for Decryption Keys
The University of Calgary ransomware attack occurred late last month and resulted in computer systems being severely disrupted. The IT department worked around the clock in an attempt to contain the infection and restore computer services one by one. While the University had made backups of critical data, the decision was taken to pay the attackers’ ransom demand as a precaution. To obtain the decryption keys the University had to pay the attackers $20,000.
However, even after paying the ransom, unlocking the encryption and recovering data has been a long winded process. The decryption keys had to be assessed and evaluated, and the process of decrypting the infection took a considerable amount of time.
If multiple computers are infected with ransomware, separate decryption keys are required for each device. Each computer must be restored separately and decryption keys do not always work and may not allow all data to be recovered.
The keys have to be used with care and an infection can take up a considerable amount of an IT department’s time to resolve. Systems and data need to be checked after the infection has been removed and additional cybersecurity measures implemented to protect against future attacks.
The University of Calgary ransomware attack has cost tens of thousands of dollars to resolve and shows that paying the attackers ransom demand is not a quick fix that will enable files to be quickly recovered. The recovery process is time consuming, expensive, and requires a considerable amount of resources.
During the time that systems are down, workflows are seriously disrupted. In the case of university ransomware attacks lives may not be put at risk as is the case with healthcare attacks, but the costs of ransomware attacks on universities can be considerable. The total cost of resolving a ransomware infection is far in excess of any ransom payment.
Protecting Against University Ransomware Attacks
Unfortunately for universities, protecting against ransomware can be difficult as public and private networks often overlap. Staff and students are often allowed to connect personal devices to networks, and controlling devices that connect to networks can be a difficult task. While businesses can conduct cybersecurity training and can teach staff basic security best practices to adopt, this can be difficult for universities with huge volumes of staff, students and researchers.
It is therefore important to implement a number of strategies to reduce the risk of a ransomware attack being successful.
It is essential that regular data backups are made and backup devices must be air-gapped. Staff and students should be encouraged to save files on backed up network drives, and cybersecurity training should be provided where possible. Students should be informed of the risk and advised of security best practices via email and noticeboards.
Many universities already use a web filtering solution to control the content that can be accessed via university wired and WiFi networks. Web filters can also be configured to reduce the risk of drive-by malware downloads. Anti-spam solutions can also prove effective as part of a multi-layered cybersecurity strategy and can prevent malicious emails from being delivered.
Technology should also be implemented to identify intrusions when they occur. A network intrusion detection system is a wise precaution alongside traditional anti-virus and anti-malware solutions.
It may not be possible to prevent all university ransomware attacks, but it is possible to manage risk and reduce the damage caused if ransomware is installed on devices or networks.