Good business practices include having regular backup of your key documents, bookkeeping, website, emails, and databases including your Electronic Medical Record (EMR). If your information is personal or sensitive – to you, your client, or your business – the backup should also be encrypted.
Your backup plan should include a backup of your information in a separate location than the source documents. In case of a catastrophic failure – including bad weather, fire, theft – you can access your key information assets quickly. You could manage the backup yourself or outsource it to a remote backup provider.
So here's the question – where is your encryption key? Your encrypted backup files need a ‘key' or algorithm to de-encrypt the files so that you can read and access the information. Have you kept a copy of the encryption key in the same place as your source documents? Or have you kept the key in a separate location – away from the source documents and away from the backup files? Have you recorded in your disaster plan how to retrieve the key?
Carl Young of PlanetCom Inc, an IT Solution company in Sherwood Park, AB reports an increase number of ‘Cryptolocker' attacks to small businesses where business are being held ransom to recover their own data. Hackers embed a virus into an email which is opened by the business. The virus encrypts all of the data on the computer network locking out all authorized users until the hackers are paid to restore the data. The amount of ransom can vary, but is around 1 Bitcoin – which sounds cheap enough, but is actually equivalent to around $1100 USD on the open market.
How can you help yourself? First, make sure that you have regular full backups of your computer network. Routinely run a restoration of your backup so that you are sure that all the information that you need – both the source files and the software applications – is accessible. You can't restore the data unless you have your encryption key!
If your backup is on the same computer network that was hacked – or, perhaps, you backup to an external hard drive device that you keep plugged into the network – you will be locked out of both your source data and your backup.
Carl Young suggests taking these steps to prevent being a victim of ‘Cryptolocker':
- Backup your data regularly
- Encrypt your backup (where needed) and keep your encryption key in a separate, secure location known to more than one key person in the business.
- Rotate your backup so that at least one full backup is kept remotely from the source data
- Be cybersmart – know how to detect email virus / phishing / scams and install good anti-virus software on your network and your mobile devices that connect to your network. See our blog post “What Not to Do – Keep Your Backup Device Plugged In” for more info.