I’ve just finished reading an interesting mini-report from ESET that was compiled during InfoSec earlier this month.

Based on the responses of 200 security professionals, the security vendor has deduced that a whopping 84% of them believe their company would be screwed if its systems became infected with ransomware (bogus claims of illegal activity on your part, the suggestion that you’ve been caught watching porn on your computer, the hint that your system is infected with malware or, more commonly, the encryption of everything on your hard drive – basically something you’ll have to pay to rectify).

In fact the problem is so bad that 31% of them say the’d do the unthinkable and pay up to get their data back or otherwise make the problem go away.

Now that, in my opinion, is rather alarming.

That a small one-person company could find itself in the position where it had no viable off-site backups in place is an unfortunate scenario. That a non-security-centric business could have a workforce that isn’t sufficiently trained and aware of the risks associated with malicious email attachments, messages from strangers on social networks and the dangers of visiting ‘dodgy’ or otherwise corrupted website links is a problem we’d all like to think is a thing of the past, though we can almost understand it.

But for an organisation of a certain size; the size that dictates they employ at least one security professional who made the trip to Olympia earlier this month, to be in the position where they see the risk of ransomware getting onto their systems as such a huge issue is, well, unforgivable.

Isn’t it?

Ok, maybe that’s a bit harsh – even the best can potentially get caught out and fall prey to data-taking malware (training, awareness, did I mention those?) but to not have suitable backups in place is bordering on the reckless.

Given how ransomware has hit the headlines recently – a return on investment of 1,500% really is rather impressive – and how the cost of duplicating data is relatively low, what exactly is the excuse for not backing up I wonder?

Ransomware is a real problem once it takes hold, offering the simple choice of paying up or losing everything. If you pay up, like the Maine Police Department recently did, you’re funding the very criminals who create the ransomware in the first place. If you don’t pay, and don’t have untainted backups, you’re in trouble.

So, please do install security software. Please train your staff. Please keep off-site backups that you update and check regularly. And do keep everything else patched and up to date.

As Brian would say,