Ransomware 101

Any kind of virus is scary. The idea of the technology you use turning on you is unsettling at best. As we come to rely more on computers, smartphones, tablets and the cloud, a single cyber attack can be devastating.

And yet, there is one form of cyber attack that stands out. Ransomware is singularly chilling. When this malware finds its way onto your device, it demands payment . . . or you lose your files. Forever.

While ransomware may seem like a new form of cyber attack, it’s actually been around for a while. In fact, the first known ransomware attack happened in the 1980s.

Attack Number One

It was 1989, well before email or Instagram. The average PC user wasn’t logging into the internet, so the delivery method of that first ransomware attack may seem low-tech by today’s standards. It came on floppy disks.

20,000 of them.

The disks were distributed to users in 90 different countries, each labeled as a product of the PC Cyborg Corporation. No such company exists, but no one was counting on name recognition to get recipients to use the disks. They were counting on the content.

The disks included software designed to detail a person’s risk of contracting AIDS. In those days, AIDS was both terrifying and mysterious. New information was welcome, especially if it promised some measure of protection. The attack played on a common fear.

The software included a legitimate risk assessment tool, as well as a virus. After the user rebooted their computer a set number of times, they would be prompted to turn on their printer. At that point, a literal ransom note would print, along with instructions for paying the ransom (or “licensing fee”) in exchange for decryption software.

It was a deviously creative plan, and it set the stage for modern ransomware.

The Modern Threat

Alert aware iconToday’s ransomware is fundamentally the same as that first attack, though there are some notable differences. The delivery method, for example, has changed. We’ll cover that in more detail in a bit.

Keeping your organization safe may seem like a tall order. There are so many clever ways a cyber criminal can infiltrate your network. Not only that, but ransomware attacks are alarmingly common.

And yet, the best cybersecurity is really just strict adherence to some basic strategies. In other words, it seems complex, but it’s not.

If you’re serious about protecting your company – and you should be – there’s a two-pronged approach that will stop most ransomware dead in its tracks. You need solid employee education, and you need the right technical tools.

Employee Education

The vast majority of ransomware relies on a single potential weakness in your network – the user. This is particularly true for ransomware.

Ransomware can only find its way into your system if it’s invited. Without an open door, it can’t touch you. The trick is to make sure your people know how to avoid inadvertently inviting ransomware onto your network.

Let’s look at three key areas.


Phishing emails are the modern-day equivalent of the same strategy the AIDS Trojan used. Even if you’re not familiar with the term “phishing,” you’re likely aware of this type of attack. The user receives an email with a link. Click that link and malware makes its way onto your system.

The thing about phishing emails is that they only work if the user clicks on the link, opting to download something. If the recipient doesn’t do that, nothing happens. Unfortunately, about one-third of all phishing emails work. Innocent users take the bait, clicking on malicious links.

The success of phishing comes down to a lack of employee education. If your people know and understand the danger of suspicious downloads, they’ll be far less likely to fall for them.

Social Media

Email isn’t the only delivery vehicle for phishing.

Here’s a common scenario. Attackers create fake social media accounts on sites like Facebook and Twitter. The newest variation is a fake account that appears to represent the customer service department of a trusted company. Attackers then watch for complaints from real customers, promptly messaging them with “fixes” . . . which are, of course, loaded with dangerous links.

Make sure your employees know of this tactic. If you or any member of your staff is having issues with a product or service, make sure you initiate conversation with the vendor. Don’t trust anyone who initiates conversation with you without first verifying the authenticity of the account.


Remarkably, there are still a lot of folks out there using painfully ineffective passwords. In a recent survey. A surprising number of users were actually using the password “123456.” That’s not just an invitation for cyber attack. That’s a neon sign with a laser light show and door prizes.

Instruct your employees to use strong passwords, and encourage them to change them often.

Hidden predictable password

Technical Tools

In addition to employee education, there are some things you can do on the technical side of your network to protect your company from ransomware attacks. Like employee education, these aren’t particularly difficult to execute. But don’t be fooled by their relative simplicity.

These are crucial steps to keeping your network safe.

Software Updates & Upgrades

In June of 2017, the Petya ransomware virus made worldwide headlines, infecting an estimated 16,500 machines. Ready for the painful twist? Microsoft released patches to address the vulnerabilities Petya exploited in May.

Software updatesToo many companies have a casual, relaxed attitude about updates and upgrades. Yes, it’s inconvenient to reboot your machine so the OS can update. Yes, it’s expensive to upgrade from the old version of a program to the new (current) version. And yes, it’s extremely important to do both anyway.

Software developers do their best to outpace cyber criminals. When they find holes in their products, they address them. But if you don’t update and upgrade appropriately, you’ll remain vulnerable.

Backups & Business Continuity

Even thorough security measures aren’t a guarantee that you won’t fall victim to a ransomware attack. After all, it just takes one employee clicking on a malicious link. Just one out-of-date program. It can happen, even if you’re cautious.

Because the threat is very real, your protection should include a worst-case-scenario plan.

Ransomware is engineered to hold your data hostage. That can ruin a business – unless you have recent backups and a solid business continuity plan. If you’re prepared, even a successful attack won’t unravel your company’s stability.

A word of caution here, though. Business continuity isn’t something we advise doing on your own. But, that’s a perfect lead-in to our final technical tool . . .

Cybersecurity Partner

A cybersecurity partner should be a part of your ransomware defense plan. Particularly if you don’t have an internal IT department. There’s no substitution for expertise. Working with the pros makes protection much easier to manage.

A well-qualified cybersecurity partner can even handle employee education on your behalf.

CCS Technology Can Help

Ransomware is a serious threat. That’s why we recommend a serious, proactive response. The individual parts aren’t all that complex, but each piece is important.

If you’re looking for ways to shore up potential security holes in your network, the experts at CCS Technology are here to help. We have years of experience helping small businesses just like yours. We know what it takes to stop ransomware.

Plus, we’re just a phone call away. Let us know how we can help you.

Closing the most common cybersecurity holes

Are you sitting down? We’re going to begin with an alarming stat.

Half of all small-to-medium-sized businesses have encountered at least one cyber attack. Wait. It gets worse. In cases involving theft of data, SMBs spent an average of over $955,000 to recover from the attack. Even for businesses that do post profits in the millions, nobody wants to drop that kind of money on a cyber attack.

There’s a host of things you can do to protect your business from cyber criminals, but one of the most important security measures is easy to overlook. A staggering number of cyber attacks start by targeting one specific weak point: your employees.

The average user may not be aware of the creative, devious ways hackers work. To give your business an instant cybersecurity boost, start by educating your people.

If you’re wondering what your staff needs to know, you’ve come to the right place. Below, you’ll find several critical tips and tricks any SMB can put into play immediately. While a cybersecurity training session may not be the most exciting way to spend an hour, the stakes are high and the information is priceless.

Be (a little) Paranoid

First, tell your people, candidly, to ditch the “it won’t happen to me” attitude. Even tech savvy folks get duped from time to time. In the ever-changing world of cyber crime, there’s no room for arrogance. A little paranoia is appropriate.

Alert aware iconIn general, assume there are people outside your organization who want your data. Assume they want access to your network. Assume they’ll go to impressively creative measures to get it.

That doesn’t mean you have to avoid the internet at all costs. Email, web services and remote access are all necessary tools. You can’t take take your business back to the Stone Age and still be successful.

Instead, shoot for balance. Make sure your employees know the same time-saving, profit-generating technology they use every day can be turned against them. Cultivate an awareness of the possibility of cyber attack.

Security is a shared burden. Everyone on the team needs to pitch in.


If you want to see an IT guy cringe, tell him you use one password for everything, and it’s “123456.” When he’s done convulsing, he’ll most likely launch into a tirade about password security (and justifiably so!).

Tech news sites routinely warn of the dangers of using “123456” and “password” for web services, but both of those examples still show up on lists of the most commonly used weak passwords.

Hidden predictable password

What makes for a better password? Several things:

  • Passwords should be long. The generally agreed upon minimum length is 12 characters. The shorter the password, the easier it is to crack.
  • Passwords should be unique. Don’t use the same password for multiple services. If you do, one security breach can easily turn into dozens of security breaches.
  • Passwords should be complex. Include numbers, letters, and symbols. Steer clear of dictionary words as much as possible. And, no, obvious substitutions (like using a zero in place of an “o”) don’t do nearly as much to discourage hackers as one would hope.

Of course, passwords also have to be memorable, which is one reason why so many employees use low security passwords. To get around that issue, consider using a password manager. LastPass, for example, makes it a breeze to up your password game.

Stranger Danger!

Email SecurityEmail is a prime point of entry for malware, phishing and ransomware attacks. Seemingly legit downloads and links can lead to epic cybersecurity breaches. Even if your email server scans inbound messages for dangerous content, don’t make the mistake of assuming every clickable option is safe.

Warn your employees to only download files from people and companies they know and trust. Also make them aware of the hazard of links. Cyber criminals capitalize on curiosity to worm their way into networks. No matter how interesting the article, or how cute the kitten pictures, strongly encourage your staff to never click on email links from unknown senders.

Other Tips

Consider the above the big three. If you only have a few minutes with your employees, those are the tips you should share first. If you can carve out a bit more time, here are some other areas worth covering.

  • Updates Are Your Friends. Way too many people ignore update notifications. Even if you’re right in the middle of a flow, churning out work, when your software or operating system requests permission to apply an update, do it. Keeping your tools updated is a basic rule of cybersecurity.
  • It’s Good to Share. In this case, we’re talking about sharing to a local server or the cloud – AKA, backing up your work. Never rely on a single version of any file. All your data should be duplicated somewhere secure.
  • Lock It Down. When an employee walks away from their workstation, they should always lock it. Not only will that protect staff from . . . interesting aesthetic changes applied by coworkers (think David Hasselhoff desktop wallpaper), but it also adds an additional layer of security. Lock computers when not in use, especially if guests are frequent in your office.
  • Know Your Network. When you’re mobile, be careful about the Wi-Fi networks you use. Public networks are convenient, but not always safe. Be discerning. And never use an open, unknown network. That’s just asking for trouble.

Go over these cybersecurity tips with your employees, not just once, but repeatedly. Bad cybersecurity habits are hard to break. Frequent reminders will help you close some of the most common holes in your network security, helping to stave off costly attacks.

If you’d like even more help shoring up your cybersecurity, the expert team at CCS Technology can help. We know what it takes to protect businesses. To find out more about how we can help, contact us today.


4 tips for securing your enterprise resource planning software

In the Oscar-winning drama The Social Network, Mark Zuckerberg and Eduardo Saverin are two Harvard college students working to create what is now the most widely used social networking site in the world: Facebook.

There’s a scene from the film where a crowd of students cheer on five nerdy guys furiously typing on computers. Zuckerberg looks on while Saverin approaches him, asking what’s going on.

“They have 10 minutes to get root access to a Python web server, expose its SSL encryption, and then intercept all traffic over its secure port.”

Saverin replies, “They’re hacking.”

Turns out, these five guys are participating in a “hackathon.” One where, according to the rules, they take a shot every 30 or so seconds.

To these students, hacking is a game. Something fun to do at a party. In the business world, it’s anything but.

The possibility of a cybercriminal breaching your business network and gaining access to sensitive company data is very real. And very serious.

One of the ways a hacker can do this is through your enterprise resource planning software. We’re here to help you prevent that from happening.

Why is ERP security important?

Enterprise resource planning software has the potential to give an overview of your entire company-wide operations, including everything from customer and financial relationships to personal data, HR information and intellectual property.

A data breach that includes ERP records would have sweeping impact. Productivity takes a hit, your reputation suffers, and revenue could easily dip. And if your business is subject to compliance regulations, you could be looking at hefty violation fines, too.

The key to avoiding these headaches is a robust network and application security designed specifically to protect all your data, including the information managed by your ERP solution.

Here are 4 tips to help you better secure your ERP software.

  1. Update, update, update.

Forgive the repetition, but this first tip is just that important. Update your network security and upgrade your application software to the most current release. Due to ERP’s integration into nearly every area of your company, a breach into one are of your network can expose your entire system to hackers.

Patching your system will protect against new malware threats and fix bugs. Plus, updates can introduce new software capabilities unavailable in previous versions.

Since enterprise resource planning software is massive, performing updates will take longer. Scheduling them outside of business hours will help you eliminate update-related downtime.

  1. Control user access.

If anyone in your company can access all the information in your ERP, then in the famous words of NASA Mission Control, “Houston, we have a problem.” Allowing every employee to see every module’s information is a security risk. And, depending on the data, a potential compliance violation.

“66% of data protection leaders admit that employees are the weakest link in an enterprise’s security posture.” – Ponemon Institute

To prevent internal attacks or accidental data removal, define permissions for different features in your ERP and require employees to frequently change their passwords. If an employee doesn’t need access to certain information to do their job, they shouldn’t have it. An experienced professional can help you set up these permissions.

  1. Train your employees.

Piggybacking onto our previous point, it’s essential to acknowledge that employees pose a substantial security risk, so be sure you take into consideration segregation of duties when allocating permissions. Sure, your staff means well. But humans, by nature, have a larger predisposition for error than machines.

“60% of respondents believe employees lack adequate knowledge of cybersecurity risks.” – Ponemon Institute

That’s why it’s critical to train your team on cybersecurity best practices. If your team knows how to spot and report unusual activity in your ERP, you can greatly reduce a cyberattack’s damage.

  1. Use active reporting.

Visibility is crucial. If an issue occurs, you’ll need to know where in order to resolve it. Real-time, internal reporting can help by letting you see problematic user activity as it happens and trace data quickly and efficiently. Run frequent audit reports in your most sensitive ERP modules.

For example, if users try to access data without the required permissions, you’ll know. Once you’re made aware, you can address the issue immediately, minimizing potential damage.

Securing your enterprise resource planning software.

Taking a preventative approach is always the best way to approach network and application security. While there’s not a universal solution, these tips should provide you with a solid foundation for securing the sensitive data in your ERP.

Related Blog: The Advantages of ERP for Small and Medium-Sized Businesses

Aerosmith and the art of rockin’ IT solutions

Tell me how it is that you can sleep in the night, without thinking you lost everything that was good in your life to the toss of the dice?” – Aerosmith, “What it Takes”, (Pump, 1989)

Steven Tyler totally has the right idea on the song “What it Takes”. You never want to roll the dice when it comes to IT solutions. Inspired by some of Aerosmith’s greatest tracks, here’s a setlist of rockin’ IT solutions for your office.

Dream On

Ever catch yourself daydreaming, head in the clouds? In your business, that’s not a bad idea. Introducing a cloud-based solution to your business will help you streamline your workplace systems, improve your operation and reduce overhead costs.

Right Scale reports that “Companies now run 79 percent of workloads in cloud, with 41 percent of workloads in public cloud and 38 percent in private cloud.”

Cloud solutions allow for ease of installation, lower payroll hours, and scalability for growing businesses. Those are pretty impressive stats, right? If you know anyone in business who thinks they can move forward without incorporating cloud solutions, you can probably tell them to “dream on.”

Just Push Play

Often, apps exist that are perfect for your business. When they aren’t, you need the capability to develop your own apps that are customized to fit your specific business needs.

App creation is also super beneficial when accounting for the increase in employees who need to be able to work from mobile devices. The proliferation of mobile apps in business actually casts a shadow on those not yet in the app game. Adobe reports that “61% of organizations believe that if a company hasn’t deployed any enterprise mobile apps yet they’re at a competitive disadvantage”.

Whether you’re building internal apps for specialized workflow or customer-facing applications to better engage clients, the goal is to create something that fits your business so well that all you have to do is “just push play” and you are ready to get to work.

Back in the Saddle

Picture this: It’s a sold-out stadium show for Aerosmith. Steven Tyler saunters out and takes center stage, his ego boosted by the adoring applause of tens of thousands of fans. Joe Perry follows suit, retrieving his beautiful Les Paul Gibson guitar from its stand. And it’s totally busted. For some reason, the roadie forgot to string the guitar. It’s sitting there with one D string, the other five tucked away somewhere backstage or on the tour bus. What’s a rock star to do?

This is a situation that happens often with technology, particularly if you have been handling your own system backup and software maintenance.

What would Joe Perry do? He’d do the same thing any IT team would suggest. He’d reach for his backup. If you’re Joe Perry, that means you reach for one of the other 600 guitars in your collection. If you’re a business owner, you need your own redundancies in place to keep the business going if your systems are interrupted for technical or human reasons, which can vary from the mundane to the criminal.

In fact, you may even want to work with your IT team to add a foolproof disaster recovery plan for any situation to the list of your IT solutions and you’ll be “back in the saddle” in no time.

We would be happy to jam with you about more ways to incorporate rockin’ IT solutions into your business. Feel free to give us a call or shoot us an email.

Is your network safe from cyber attacks?

Before the landmark work of Louis Pasteur and Robert Koch, humanity had some . . . interesting explanations for causes of disease. A prominent theory held that “bad air” was to blame for ailments. Odd though that sounds, it makes sense.

With no knowledge of germs, people relied on basic observations about sickness and health. They saw that people living near foul odor (like primitive sewer systems) were more likely to fall ill. The most noticeable issue was the smell – hence the theory.

Eventually, Pasteur and Koch would develop what is now known as “germ theory.” This changed how we conceive of disease. But there’s a valuable lesson in humanity’s previous mistaken understanding.

You can’t adequately protect yourself from something if you don’t understand the true nature of the threat.

When your network gets sick.

There’s a modern, technical equivalent to germ theory: cyber crime. On some level, we all acknowledge the similarities. After all, we call malicious software “viruses.”

Unfortunately, a lot of business owners understand as much about ransomware as folks in the Middle Ages understood about bacteria. Too many of us talk about malicious software like it just appears out of the ether.

We know how horrible viruses are when they strike. But do you really understand where they come from? If you don’t, your network could be exposed.

The origins of malware.

Malware doesn’t spontaneously appear. Viruses and ransomware are the direct results of intentional effort. Said another way, cyber attacks start with cyber criminals.

Their motivations vary from financial gain to political statements. Their objectives are the same either way. Cyber criminals create malware to disrupt computer systems and take networks offline. Even if they don’t make money from the attack, the financial impact on affected businesses is still considerable.

The effects of cyber crime.

A recent Business Insider article starts with this ominous opening line.

“Warren Buffett sees cyber attacks as a bigger threat to humanity than nuclear weapons.”

That may sound like a dramatic overstatement, but the most recent cyber crime statistics lend Buffett’s assessment uncomfortable credibility. Cybersecurity Ventures estimates that the total cost of cyber crime will hit $6 trillion dollars by 2021. (Yes, that’s “trillion” with a “t.”) What’s more, half of all small to medium-sized business experienced at least one cyber attack in the last year. Finally, according to the Denver Post, “60% of small companies that suffer a cyber attack are out of business within six months.”

The financial impact of a single cyber attack is significant enough to undo the foundation of your business. That’s no small thing.

Stopping cyber crime.

You can’t stop something if you don’t understand it. Our efforts to stop literal epidemics weren’t nearly as successful as they could have been before we understood germ theory. Similarly, stopping cyber crime comes down to understanding the very nature of it.

If you want to protect your company, you have to tap into some serious know-how.

Of course, most small business owners don’t have the time for that. It can take years of experience to really understand the nature of cybersecurity. On top of that, the landscape of cyber crime is always changing. It’s not easy to stay current.

Which is why so many small businesses turn to outside help. Not only does it save you time, but it could easily save the future of your business should you experience a cyber attack.

CCS Technology and cybersecurity.

Here at CCS Technology, we understand the complexity of keeping your network safe. We know what’s at stake, and we know the kinds of tactics cyber criminals rely on. We have a consistent track record of safeguarding our clients, and we can help you beef up your security, too.

If you’re interested in giving your organization the protection you need from cyber crime, get in touch with us today. Our friendly technicians are ready to walk you through every step of the process.

Related Post: Cybercrime: 5 Things You Need to Know