Ransomware & Your Website: How to Mitigate Your Risk

p>It’s been a few months, and many may have forgotten, but last year ended with a big story in the digital world when Managed.com, one of the largest providers of fully managed web hosting solutions, was a victim of ransomware. First announced on November 16th, some customers were offline for many days, and others were left fearing that restoration could take weeks.

This isn’t a new threat – ransomware has been around for quite a while. Last year, Garmin was taken offline, rendering many of their GPS-based gadgets useless as the “cloud” was inaccessible. Not a significant issue for folks updating the firmware on their GPS watches, but not a great situation for pilots who rely on Garmin’s navigation systems and needed to update software to stay legal by FAA standards.

And let’s also remember the city of Atlanta, who lost a substantial amount of their systems, which resulted in them paying a ransom in the area of $2.7m! And let's not forget the cases of the Hollywood Presbyterian Medical Center, the Ottawa Hospital, Kentucky Methodist Hospital, and even the San Francisco Municipal Transportation Agency. They are all victims in recent years of hackers who will tie up your systems in exchange for some sort of payment (typically of the crypto-variety).

For the most part, our client base consists of web and mobile applications, whether commerce, CMS, or similar. This article explains a few techniques you can consider to minimize your risk of being a victim of such an attack. While nothing is ever 100% preventable, there are steps you can take to ensure that even if you are attacked, you have options in place and retain some semblance of control over your situation. Of course, the responsibility of hosting and infrastructure providers is to mitigate these risks, but it never hurts to have a strategy on your side just in case. 

Beware All-in-one Providers: Diversify

This is a crucial first step to consider in terms of taking control of your digital world. Because the nature of managed.com is that they do so much for you, it’s easy to assume that you can be completely hands-off. In reality, diversifying a bit is the safer play. Of course, this may mean you’ll have more work ahead of you, but when an outage happens, it may leave you looking at correcting one issue and not many.

What areas can you diversify? One would be to make sure you have separate homes for your development/staging environment and your live environment. Many hosts have both in the same infrastructure. One great example that comes to mind is WP Engine - they offer clients both development and live environments for their websites. This is very convenient, and it does follow one basic tenet of development environments, which is to have the live and dev environments be essentially similar. However, if a catastrophic event were to occur, you would love both environments. Many times in the past, we’ve utilized a dev site as a temporary live environment during a catastrophic outage – in this case, that option would not be available to you.

Again this is just a single example. Others may include utilizing other providers for CDN or caching, distributing DNS to an outside service, which will protect any other services that operate domains. Also, don’t forget about your email capabilities – I always prefer running that outside the infrastructure of your website provider. The list goes on and on, but the key here is to consider what options exist to quickly restore yourself if the providers are dealing with thousands of unhappy customers and can’t focus on your situation.

Portability & Backups

As I mentioned above, having the ability to restore your site quickly is essential in an outage. The above example was to utilize a dev site as a temporary live environment – a viable solution. One other area you should focus on is the idea of pulling backups – even if your host is an all-in-one solution.

Having backups is essential in that if properly executed, you can restore at an alternative host in hours instead of waiting for restoration with your current host. But, not all backups are created equally. Almost every all-in-one provider will claim they perform backup services. However, they miss one crucial, critical component for the most part – they keep the backups often within their same infrastructure. This means if they undergo a massive attack, you can’t even access the backups.

Having your backups in an offsite location is a more thoughtful strategy. As such, finding a way to run automated backups to a third-party or other site is essential. In the Managed.com scenario, we had clients who were knocked offline with no access to their “backups,” thus rendering them utterly helpless in this instance. That is not a good situation to be in, so having a decoupled backup strategy is essential to retain some control.

Policies & Procedures

In the case of Managed.com, it was more destructive than usual as many of their clients had no plans or policies in place for such an outage. They all assumed everything was, well… Managed. And this isn’t a flawed assumption – that is what the company was selling. However, this lack of preparedness made things much worse, leaving companies offline for long periods.

Organizations should define policies to oversee these services and encourage best (or better) practices, such as the steps mentioned above. For the most part, these situations are often avoidable, and maintaining control is manageable. You have to be prepared for the worst-case scenario – and trust me – globally, we’ve seen how odd, catastrophic things can happen as of late.

A Helping Hand

Finally, although these services have support teams – they aren’t often ready for thousands of customers being down at once. At that point, you are quite literally on your own in terms of figuring out what’s going on. Having a third-party on call for support and assistance is something that can help you as you navigate the stormy waters of an outage. This need not be a company or service provider; often, a consultant or agency will do. Someone you know will not be inundated with other support requests, and is familiar with your situation, in particular, is worth keeping around.

Just in Case: Insurance Coverage

One major issue that you need to be prepared for is your potential liability. When a site is hacked or has excessive downtime, you need to be sure that you will not bear the liability burden. Most of the managed service providers are going to carve out clauses to indemnify themselves in these instances. You, too, need protection in case your customers are relying on your services. Insurance is a bit outside our wheelhouse, but many companies do provide cyber liability policies. If you need a great broker, have a look at Insure Your Company for more specific details.

In Summary

One of the issues with these types of hacks is that human behavior dictates that no one ever thinks these events will happen to them. That feeling is prevalent both with clients and the providers themselves – almost every provider advertises themselves as being secure against these events. However, taking some simple steps to enhance your options in the case of an outage is a prudent thing to do. The Managed.com case left thousands of customers unknowing of the issue's disposition and powerless, costing them revenue and credibility. With little to no recourse, the host indeed has built this scenario into their legal terms to protect their liability. Hopefully, some of these suggestions above are easy for you to put into place for your website, avoiding such a headache in the future.