A nasty new version of “ransomware” has been making the rounds on the Internet, putting millions of personal and corporate files at risk. Instead of stealthily copying data and sending it somewhere else, this type of Trojan virus encrypts the data in an unbreakable algorithm, then demands payment for the key to unlock it.

“This kind of malware is not new but over the past 18 months it has become significantly more prevalent and the malware authors have written significantly more clever and scary versions,” writes James Lyne, global head of security research for Sophos. Even after security tools clean out the virus, the files remain encrypted. The latest variation of the threat, called CryptoLocker, includes a countdown timer which demands a payment of $300 within 72 hours or else the key file will be deleted.

Hopefully, law enforcement will catch up to the creators of this and other viruses, but unfortunately, there will be others. This is only the latest reason – as if any more were needed – for continuing, comprehensive employee education on data security. In addition, it points to the urgency of making sure that all important data is backed up and available on a continuous basis.

Here are some best practices every organization needs to engage in and maintain:

Education and training: This is the first, and best, line of defense for organizations. Build a security-aware organization, in which employees can effectively “police” their own domains, following best practices such as not opening suspicious emails or visiting non work-related websites.

Your own encryption: After employee engagement and training, this is the second best line of defense against data theft or corruption. You may have the best technical defenses in the world at your production site, but what happens as data is sent out to development groups or backup sites? How secure are these parties, even if they are still part of your organization?

Monitoring and auditing: Companies don't do enough monitoring and auditing to ensure that unwarranted access is taking place. In surveys I have conducted, many companies only audit their access logs every few months or so. By then, it may be too late.

Technical tools:  Finally, there is a range of security solutions that help ensure that databases, servers, networks and client devices are protected against unwarranted intrusions.

Joe McKendrick is an author, consultant and blogger specializing in information technology. This blog originated on Insurance Networking News, a SourceMedia publication.

Register or login for access to this item and much more

All Health Data Management content is archived after seven days.

Community members receive:
  • All recent and archived articles
  • Conference offers and updates
  • A full menu of enewsletter options
  • Web seminars, white papers, ebooks

Don't have an account? Register for Free Unlimited Access