A Consumer’s Guide to Protecting Important Data From Ransomware
It is hard to pick up the paper these days without reading the latest headlines about data breaches and ransomware attacks. The news flow makes it seem that large companies with deep pockets are the only ones that should worry about ransomware. However, the reality is that more individual consumers are affected by ransomware than individual companies. Journalists will not write a front-page article about an individual’s personal photos and documents becoming encrypted, but that does not mean the risk can be ignored. If you are a consumer and you store digitized data of value, that data is at risk of encryption from ransomware.
How you store and access digital data dramatically affects your risk of permanent data loss. Luckily, as a consumer, you have all the flexibility to control and minimize those risks. Corporate bureaucracy can hinder companies from easily adopting simple solutions, but as an individual, you can do whatever you want! There is a myriad of free tools and services that will dramatically lower your risk of data loss. Below is a 3-step process to minimize your risk of data loss due to ransomware and other threats.
1. Categorize Your Data
The type of data you have and how easily you need to access it should drive your data categorization strategy. We classify personal data into two buckets: Keep-Sakes & Records and Day-to-Day Data
Keep-Sakes & Records
This category includes important photos of your family, friends or other personal images. It also includes legal records like wills, tax records, property records, medical records, and other important documents. Not sure if a picture or document fits in this bucket? Ask yourself, “Would I regret losing this [ photo, tax document, etc.] in the future?” If so, you have keep-sakes & records that require a strategy for long term preservation.
Day-to-Day ‘Stuff’
The second category includes the short-term documents you can easily recreate or do without. Data in this bucket can be lost without significant impact on your daily life or replaced without significant cost or hassle. Unsure if something falls into this bucket? Ask yourself, “Would it ruin my afternoon to recover this?” If your schedule is clear that sort of data is Day-to-Day stuff. So, what’s next? Now that you have classified your data, how should you store it? Use the below matrix and explanation as a guide.
How to Safely Store Keep-Sakes & Records
Keep-Sakes and Records should follow the 3-2-1 rule. You should have 3 independent copies of this data: first, a ready copy of this data handy if and when you need it. Second, you should back it up to a cloud storage provider like Google Drive or Dropbox. Online cloud storage is free or very cheap and is designed to prevent data loss from ransomware. And third, should have a local off-line copy on a physical storage device. Offline backups in the form of high capacity USB’s are also very cheap compared to the cost of losing this data. Set aside a few hours one day and back up this data. Set a reminder to do it again in 6 months. You can thank us later (or face-palm yourself for not doing this when you get hit with encryption ransomware).
How to Safely Store Day-to-Day Stuff
Losing your day-to-day stuff is not going to send you into mourning if it gets encrypted by ransomware, but given the ease of use and cost of cloud storage these days, there is no reason to make life hard. Sync your day-to-day files and data to a cloud storage provider of your choice, so that WHEN your data is lost or encrypted, you can restore it without skipping a beat. Most cloud storage can withstand being compromised or encrypted with short term restore points readily available (caution, go past a week or two without restoring and that option may disappear).. We CAN live without our day to day stuff, that is why we only had two copies of it.
2. Practice Basic Security Hygiene
Now that we know how to back up our data, it is time to change our behaviors a bit. Despite the value of your digital data, keeping it safe can seem wildly inconvenient. Who cares about patching or installing updates when you have much more fun (or important) things to do? The key is to change the way you view these activities. Don’t think of activities as costs or hassles, think of them as investments that pay off when you avoid a data loss related catastrophe. Your security hygiene should involve:
Patch! Always patch and upgrade to the latest anti-virus and OS version when prompted. Patches are issued to fix vulnerabilities. These vulnerabilities may make your device exploitable. First, verify that the patch is legitimate then take 30 seconds to install the patch. If you need to restart your computer but are afraid of losing all your browser windows… don’t be afraid. Restart your computer.
Use strong anti-virus software: There are a lot of very high-quality anti-virus products available to consumers these days for very little cost. Using high quality AV on your personal machines will dramatically lower the chance of ransomware testing your backup strategy.
Verify before you click: Try to avoid clicking on any unsolicited link sent or presented to you. If you do a google search, by all means, click on the intended results. If you intrigued by an email offering pharmaceutical drugs, maybe skip it. Also be leery of advertising links on websites, online games, and apps. If you are curious about the product or offer, open up another tab and google it. Avoid clicking unsolicited links.
Use two-factor authentication: Here is a rule of thumb for two-factor authentication (2FA): If you care about keeping bad guys out of the account, use 2FA. Use 2FA on your email account, your bank account, or any online account that holds value. It’s an easy step to adopt, and the relief of knowing it’s in place is worth the effort.
Mobile hotspot vs Free Wifi: Feel like cracking open your laptop in your local Starbucks? When browsing outside of trusted networks, tether up to your phone’s hotspot vs using a free wifi service. Every packet of data that arrives or leaves your laptop could easily be lifted if you are using a free wifi network. Data is cheaper than ransomware.
Use a password manager: I know, this sounds like YET ANOTHER THING that will slow you down. In reality, the cognitive load of remembering more than a few passwords is more of a hassle than using a password manager. It’s possible that MOST of your passwords are floating around for sale (go ahead and check!), so it’s worth using a password manager and that helps change your passwords regularly.
3. Be Paranoid!
At this point, you may be asking yourself, “wait, what kind of data is okay to JUST keep on my local machine, or home office server?” The answer is simple. Assume that you will lose everything stored locally on your personal computer or internet connected server.
This brings us to our final step, and, yes, this is actual advice. The threats facing consumers these days are diverse and constantly changing, but there is one constant. A personal security incident is often preceded by something that is JUST slightly out of the ordinary.
Your computer starts running slowly. Run AV or immediately install any outstanding patches.
Your phone reboots or starts running very hot. Bring it into your carrier and describe the symptoms.
Phone acting weird? Call your carrier and ensure your account has not been swapped.
Lost access to an account? Change up all your PWs using your password manager.
Anything else? Make sure you have an up to date, offline copy of your keep-sakes & records.
In short, trust your spidey sense! These are signals that the non-paranoid will brush off. However, if you are just paranoid enough, you can recognize these glitches as a warning.