10 Tips for How to Defend or Prevent Your Business Against Malware Attacks

Malware and ransomware attacks increase by the day. In the last eight years, [more than 7.1 billion](https://www.symantec.com/security-center/threat-report) identities have been exposed in data breaches. The amount of malware is growing. While banks and high-level government officials are often a target, even small businesses are prone to such attacks. We look at best practices to avoid or prevent malware attacks.

Definitions

• Malware is a combination of malicious and software.
• Ransomware is a type of malware that locks the system, takes data, and then encrypts it. Hackers demand ransom in exchange for the data or threaten to publish it.
• Phishing is an email attack that encourages the reader to click on a link, which takes them to a dummy site where you fill out your information.
• Spearphishing targets a specific organization or person, looking for sensitive data.
• Spyware is a way of watching as a user logs into a computer. Similarly, keylogging software enables hackers to steal passwords as people type them in.
• Malvertising is malware embedded in online ads.

Such attacks often focus on email, an easy target. According to the 2017 Internet Security Threat Report by Symantec, attackers “have honed a business model that usually involves malware hidden in innocuous emails, unbreakable encryption, and anonymous ransom payment involving cryptocurrencies.” The business model is working well, which is why more hackers are getting into this game. Symantec logged a 36 percent increase in ransomware infections in 2016.

Even those who don’t pay ransom or lose information have to pay in other ways, disinfecting machines and restoring backup data. That might mean weeks of downtime.

Part of the problem is that malware continues to evolve, bypassing your antivirus protection. That means your IT team and company has a lot of work to do to keep up like identifying malware and prevent malware attack. According to a study at the end of 2016, 52 percent of organizations that suffered successful cyber attacks in 2016 weren’t making any changes to their security in 2017.

10 Best Security Practices to Avoid Malware for Businesses

Cybersecurity is a challenge for everyone to address, even small companies. Business must work to protect their employee and customer data. Here are 10 best practices to follow.

1. Use multiple, overlapping defense systems, including web security gateway solutions, firewalls, gateway antivirus, intrusion protection or detection, and website vulnerability with malware protection.
2. Stay up to date with the latest attacks from known groups. Patch any vulnerabilities as soon as possible.
3. Create a company security policy. More importantly, enforce that policy. Any sensitive data should be encrypted both at rest and in transit.
4. Require strong passwords for all team members and customers. Passwords should be at least eight to 10 characters long, with a mix of letters and numbers. Forbid your team from sharing passwords and remind them not to use the same password on multiple sites. Require team members to change passwords regularly. Use two-step verification as much as possible.
5. Quickly delete old and unused accounts, profiles, and credentials.
6. Educate your team about emails. Teach them about various types of malware and phishing attacks and urge them not to open attachments. Tell them to delete anything suspicious or emails that require macros to view content.
7. Make sure your team members’ computers have updated software and operating systems.
8. While email and software downloads are easy targets, don’t forget about hardware. Make sure no one walks away with computers by tightening up security around the office. Stolen hard drives or even thumb drives can leave you open to attack.
9. Back up your files as often as you can or as often as necessary. Remember, backup drives should only connect to a machine during a backup, then disconnect, to minimize the risk that it, too, becomes infected.
10. Prepare for an attack. Create a response plan in case of a cyberattack. This plan should include instructions for the team on what to do during an attack and how to continue work afterward.

Identifying Malware: Signs You’ve Been Infected

If you suspect your computers or system have some type of malware, you might notice one of the following signs (but they might not be present):

• Pop-up windows or odd messages on the screen
• New icons or programs on the computer
• New toolbars in the web browser
• Something changes, like your browser’s home page
• Your computer is slow or crashes frequently

If You Become Infected

If your system becomes infected, shut everything down immediately. Disconnect from the Internet, Wi-Fi, and Bluetooth to keep anything from spreading. Then determine what type of infection or attack it is. You may then be able to correct the problem and restore files with your backup. This Ransomware Hostage Rescue Manual has useful information about handling ransomware attacks.

Imaginovation can help you improve security. Learn more about our custom software and database development.