Prevent Ransomware: 7 medidas proactivas para mantener sus datos seguros

Hace algunos años, los ciberdelincuentes encontraron un nuevo método para ganar dinero con sus prácticas delictivas.

En lugar de distribuir virus que simplemente destruyeron sistemas y datos, inventaron ransomware, un tipo de malware que encripta los datos de la víctima o bloquea el acceso a ellos y pide dinero para que estén disponibles nuevamente.

Ransomware took many cybersecurity experts by surprise, exploiting security holes they didn’t know they had, and seriously compromising their companies’ critical information. A single vulnerability on an IT network is enough to put at risk tons of sensitive data. In that sense, ransomware affects not only the reputation of the organizations but also their finances.

El principal objetivo de los ataques de ransomware son las empresas: cuanto más grandes, mejor. Porque, en general, tienen más recursos económicos y están en mejores condiciones para pagar un rescate que los particulares. Pero nadie está a salvo, ya que cualquier computadora, tableta o teléfono puede infectarse. ¡Sí, teléfonos también!

The most common way of distributing ransomware is email. Usually, the infection appears attached to seemingly legitimate messages. These messages ask the user to click on a link or to download an attachment that distributes the malware. Attackers typically send massive messages to millions of email addresses.

Los sitios web maliciosos y los mensajes de redes sociales también son formas comunes de distribución de ransomware.

Victims of ransomware realize they have been attacked when they are prevented from accessing their files. The attackers provide anonymous instructions to pay the ransom and recover the compromised information. No matter if the ransom is paid or not, the attackers will have access to the victim’s data and will always try to extract useful information from it.

Once the attack has been perpetrated, the victim must deal with the fact that all sensitive data has been compromised. That could include usernames and passwords, payment information, email addresses, and much more.

One word summarizes the best strategy to fight ransomware: prevention. Only if you take the necessary prevention measures, you will be able to recover from a ransomware attack, or better yet, you will simply avoid being attacked. We compiled a checklist of prevention measures that will help you fight ransomware effectively.

Mucho cuidado con los archivos adjuntos de los correos electrónicos

El software antivirus should warn you about any suspicious email attachment that you get. But don’t rely blindly on that because email messages can be easily disguised to appear as legitimate notifications from your bank, your credit card company, or any other trusted source, even a co-worker or a friend.

Before opening a file attached to a message, check the sender’s address, not just the sender’s name, because that can be falsified. Check if the domain name (the part after the @) of the address is what it should be. If it’s a strange name with no meaning at all, discard the message immediately.

The most dangerous attachments are application components, such as EXE (executable) or DLL (dynamic link library) files. So pay extra attention if you see one of these such files attached to a message. But any type of file associated with an application that opens it up automatically es potenteally dangerous. So good advice is never double-click on the attached files. Always save it to a folder and check it with an antivirus application afterward.

No haga clic en un enlace que aparece en el cuerpo de un correo electrónico

Once you do it, it could be too late.

If it’s absolutely necessary that you click on that tempting link, hover the mouse pointer (if you’re using a computer) to see where the link is really going to take you. If you’re using a phone or a tablet, you can tap on the link and keep your finger pressed to see the real URL behind the link.

Si no coincide con el texto del enlace, no lo siga y descarte el mensaje engañoso.

Cuidado con discos externos o memorias USB desconocidos

If you need to copy files from an external storage device someone gave you, don’t let it do anything automatically when you connect it.

Pida la ubicación de los archivos que necesita y cópielos (y no copie nada más) a una carpeta temporal en su dispositivo donde pueda escanearlos en busca de malware before using them. The same caution as for email attachments apply here: don’t double-click on the files or let them open or play automatically.

Juega seguro en las redes sociales

El ransomware se puede propagar por las redes sociales tan rápido como una infección zombie. A todos nos encanta compartir con nuestros amigos cualquier contenido que nos guste. Lo hacemos con buenas intenciones, pero a veces esta puede ser una forma irresponsable de propagar malware.

Si un amigo suyo le envía un enlace a algo que "debe" descargar, instalar o ver, tenga cuidado: tal vez su amigo ya esté infectado y es el ransomware el que intenta engañarlo para que abra una puerta para que entre en su sistema.

Revisa todo lo que recibes a través de las redes sociales. Algo tan inocente como ver un video de gatitos jugando con cachorros podría terminar costándote una fortuna.

Mantenga su software actualizadoate

It is vital that all the software you use comes from reliable sources and always have the latest actualizadoates installed. Changelogs (“What’s new” screens or documents) could be tedious to read, but they provide useful information in terms of what did the developer does to fix security issues and eliminate vulnerabilidades.

Léelos detenidamente para comprender cuáles fueron los problemas que resolvieron.

Asegúrate de tener un buen Antivirus y Firewall

Leer reviews and comparisons to make sure to install the best antivirus and Firewall for your devices.

Well-designed antivirus utilities should eliminate ransomware as soon as it tries to break in your system. Modern antivirus utilities add some form of behavior monitoring. Some of them, instead of looking for known threat patterns, work exclusively by observing malicious behaviors. This behavior-based technique is becoming more common as it proves its effectiveness.

Algunas utilidades de seguridad tienen como objetivo evitar los ataques de ransomware al denegar el acceso no autorizado a determinadas ubicaciones, como el escritorio o la carpeta de documentos de una computadora. Cualquier intento de acceso de un programa desconocido dispara un mensaje de advertencia al usuario, dando la opción de permitir o denegar el acceso.

Las siguientes son algunas de las mejores opciones.

Malwarebytes – probably the best anti-malware for Windows, MAC, Android, and iOS.

ESET - Protección avanzada de seguridad de Internet para dispositivos móviles y de escritorio.

Copia de seguridad completa

Many people find it too late that they don’t have a proper backup strategy. The typical problems with backups are damaged media, corrupted backup data, difficult restore procedures that take too much time, or too many people to perform, between others.

If you discover the backup problems after a ransomware attack, then your backups may be useless. A sound backup strategy should enable you to go back in time to a specific date, and restore your data to that date. You need to know the precise date when the infection began, and then restore from a backup that is earlier than that date.

Una copia de seguridad de datos confiable debe combinarse con un procedimiento de restauración rápido. También es importante que una copia de seguridad de datos ofrezca una recuperación de archivos fácil y granular para que pueda volver a trabajar con sus datos en poco tiempo.

Si no desea lidiar con programas de respaldo, medios, rotación y otras molestias, considere un servicio de respaldo en la nube. Existe una amplia variedad de proveedores de respaldo en línea, con una variedad aún mayor de opciones y precios. Tenga en cuenta que el servicio por el que pagará lo aliviará de muchas preocupaciones y evitará muchos riesgos.

¿Y si todo falla?

Even if you take all the necessary steps to prevent malware from getting into your system, nothing could guarantee that it won’t happen. So, what to do if your device gets infected?

First of all, you should isolate the infected device. Disconnect it from the Internet and from any network – wired or wireless – it could be connected. Second, you should get a clean backup and restore the infected machine to the last known “good” state. Don’t reconnect the previously infected device to the Internet or any network until you are entirely sure that the infection has disappeared.

Cambiar sus contraseñas es una medida molesta pero necesaria ya que la contraseña anterior podría verse comprometida. Para reforzar aún más la contraseña, utilice un administrador de contraseñas.

Si tiene suerte, es posible que pueda restaurar los datos dañados utilizando un descifrador de un proveedor de antivirus. These tools are explicitly aimed at known ransomware, but won’t work with files encrypted with new breeds of malware that use custom encryptionorte algoritmos.

¿Deberías pagar el rescate?

¿Pagar el rescate es una alternativa viable?

Últimoately, attackers want money, so they’ve developed marketing strategies to convince you that they are providing you a service: they are teaching you a lesson, and they are also helping you to improve your security measures.

Attackers will even offer you a “proof of life”: they will restore one of your files to show you that they are willing to resolve the situation promptly. Sometimes this is true. Sometimes it is not.

The investigation authority is watching all reported ransomware infections carefully, analyzing its spread and severity. According to the Bureau, victims should not pay any ransoms. This is a valuable piece of advice since approximately 20% of the companies that pay the ransom don’t get back the access to their data.

Debe considerar cuánto tiempo llevará recuperar sus datos por sus medios. Hable con el soporte del producto anti-malware para ver si pueden ayudarlo.