{"id":55327,"date":"2016-08-24T09:25:06","date_gmt":"2016-08-24T16:25:06","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=55327"},"modified":"2017-10-16T16:05:36","modified_gmt":"2017-10-16T23:05:36","slug":"a-laymans-guide-to-ransomware-protection","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/a-laymans-guide-to-ransomware-protection\/","title":{"rendered":"A Layman\u2019s Guide to Ransomware Protection for Mac"},"content":{"rendered":"

\"Ransomware<\/p>\n

Ransomware is no longer the exclusive Windows-only scare it once was. The first Mac ransomware was discovered in March\u00a0of this year, and it’s only a matter of time before the next one rears its ugly head.<\/p>\n

As no-one can tell you what the infection vector will be, how it will work exactly or what types of files it will go after, how do you prepare for it?<\/p>\n

As with any good security strategy, for\u00a0ransomware protection the best defense is made up of multiple layers. The first layer begins\u00a0with a trusted\u00a0security suite<\/a> that monitors your system for malware and checks your web and network traffic for malicious content. The next defense layer is you. By not downloading content or opening email attachments from untrusted sources you greatly reduce risk of infection. Another layer is backups. Making sure your data is safe is the main priority and a smart\u00a0backup strategy should be in place even if your Mac is not connected to the Internet. Let’s face it, at some point every hard drive or solid state drive fails, even if it’s never been touched by malware.<\/p>\n

OS X’s built-in backup solution Time Machine<\/a> is a good first step on the road to securing your files. Use it to backup your data to an external hard drive, local server, a Time Capsule or all of the above.\u00a0I say Time Capsule is a good first step because, even though it’s very easy to set up, it’s very limited in functionality. Also, the ransomware that was recently discovered (and surely future ransomware as well) encrypted files on external drives and mounted network shares as well!<\/p>\n

Now don\u2019t start celebratory drinking just yet, you have options!<\/p>\n

A\u00a0day in the life of ransomware<\/h3>\n

Ransomware typically infects a computer and lies dormant. Ransomware creators need to find the sweet spot between infecting as many computers as possible, encrypting the data on them, and word of the ransomware getting out.<\/p>\n

If a computer is infected and files start being encrypted right away, word of the ransomware will get out; antivirus companies will quickly update their products and thwart chances of infecting more computers. The end result may be just a hand full of computers infected.<\/p>\n

If the ransomware installs but doesn\u2019t do anything for a few days, chances of people knowing it exists are much smaller. This gives the ransomware more time to infect a lot more computers. After a few days, the ransomware contacts a Command & Control (C&C) server for instructions. If the C&C server gives the OK to get to work, suddenly thousands or hundreds of thousands of Macs across the globe will start having their files encrypted. By the time the alarm bell is rung and the world is aware, it will be too late for all those that are infected. In that scenario the potential payout for the people behind the ransomware is huge.<\/p>\n

Leaving the ransomware dormant for too long also increases the risks of it being detected. Security researchers and antivirus companies are always looking for new malware and even when dormant, ransomware leaves a trace that can be discovered by those highly skilled people.<\/p>\n

KeRanger<\/a>, the previously mentioned Mac Ransomware, laid dormant for three days before it sprung into action. The next ransomware may take a week or longer.<\/p>\n

You mentioned something about options?<\/h3>\n

Indeed I did. We want a backup solution that can backup to multiple destinations, at a schedule of our choosing and offer a variety of backup types and settings. Time Machine can back up to multiple drives,\u00a0but the type of backup destination is limited and the schedule you set applies to all backup destinations.<\/p>\n

Luckily for Intego customers that utilize Mac Premium Bundle<\/a>, a backup utility is available that does everything you\u00a0may need. Personal Backup<\/a> can:<\/p>\n