COVID-19 Cyber Crime & Fraud: Ransomware and Back-ups

Identify your critical data – For individuals that could include documents, photos, emails, contacts, and calendar information. For a business that would be data that it couldn’t function without

Restrict access and disconnect – Whether on a USB stick, a separate drive or computer, access to backups should be restricted and not permanently connected, either physically or over a network, to the original device copy.

Store backups safely – Consider storing backups in a separate location, so fire or theft won’t result in total loss. Cloud storage solutions may be a cost-effective and efficient way of achieving this. Unless running your own email server, emails are already stored ‘in the cloud’.

Cloud security guidance – Not all Cloud providers are the same, but most have good security practices. To help when choosing a cloud provider read the NCSC’s Cloud Security Guidance.

Make backing up part of your regular routine – The majority of network or cloud storage solutions now allow automatic backups. Using automated backups saves time and ensures the latest version of files is backed up.

When choosing a solution, consider how much data needs to be backed up, and how quickly the data needs to be accessed following any incident

Test your backups – You only find out how good your insurance cover is when you make a claim. Data recovery can be a stressful scenario that doesn’t need the additional pressure of worrying whether backups are valid or not. The solution is to test that backups have worked by restoring data.

How often should testing be performed? In an ideal world, testing after every backup to validate the data. This is not always practical, a trade-off needs to be made between the impact and effort of recovery and having a degree of confidence in the restore.

Hot topics

Criminals will use every opportunity they can to defraud innocent people. They will continue to exploit every angle of this national crisis.

Phishing emails claiming to be from TV Licensing, referencing the pandemic ‘We’re sorry but due to the impact of Coronavirus you will need to pay online’ are being reported.

Emails spoofing the HMRC brand asks recipients to send copies of their passport and utility bill/bank statement via a link to an infected site and another variant instructing business recipients to click on a link to complete a claim on the Coronavirus Job Retention Scheme.