ROCKFORD, Mich. (WOOD) — Most systems at Rockford Public Schools were operating again Thursday after the district was the target of a ransomware attack the day before.
As the district recovers, an expert is sharing the dangers of ransomware and how to limit its impact.
Ransomware is a form of malicious software that creates serious headaches for victims.
“It basically locks you out from the files and materials that you would need,” explained Tom Holt, a professor with the Michigan State University School of Criminal Justice. “Depending on how quickly it spreads, it can affect databases or systems that are vital for the function of an organization.”
Holt said regaining access to files usually involves negotiating payments with hackers.
“The operators themselves are making millions of dollars, just based on what we can observe in the public about the payments they receive. So it’s a high-value kind of attack,” Holt said.
Ransomware attacks are also high risk: Schools and hospitals are two major targets.
“You’re talking about attacking targets, in the case of a hospital, you can essentially generate the loss of life,” Holt said.
Holt said ransomware has mostly become an organizational problem, making it important to secure infrastructure as much as possible.
“The trade-off is you have to be able to use these resources. So you don’t want to have people constantly changing passwords or using two-factor authentication that’s hard to use,” Holt said. “So you have to find the balance between security and usability.”
He also said individuals within organizations can also help avoid problems by being vigilant because ransomware attackers often again access to an IT system using text messages and emails.
“It’s an email that appears to be legitimate, (but) maybe it’s got a bad link out to a site where you’re downloading malware,” Holt said. “So you just need to be cognizant of what the email is, who it’s coming from, what the request is like.”
Because it’s hard to go after hackers, caution is considered the best way forward.
“Most of them live in Russia and there’s no extradition relationship with Russia. So we can’t prosecute our way out of this problem and that means we’re left to deal with this as individuals,” Holt said.
Organizations are also encouraged to have their data backed up in case of an attack.
