By Eva Lorenz 

Ransomware has been an ongoing threat to law firms for years.[1] Once impacted by this form of attack, law firms struggle with issues such as how to pay ransom, which often requires some form of cryptocurrency (e.g., bitcoin). Alternately, if the firm elects not to pay the ransom, the issue becomes how to provide continuous service to its clients while staff cannot access important files from a down computer network.

While ransomware is a more recent threat compared to other forms of malware, the delivery vehicle used for such attacks has been around for decades. Most ransomware attacks start with a phishing email. Prior to ransomware, most phishing emails captured account credentials that attackers then repurposed for spam attacks. But with the advent of ransomware, attackers found a more lucrative outlet for their “creative” ideas. Studies predict there will be a ransomware attack on businesses every 14 seconds by the end of 2019, and by 2021, it’s projected that attacks will increase to every 11 seconds.[2] Educating users not to click on phishing emails is more important than ever and is a critical first step in preventing ransomware attacks. But what is the most effective way to train users to avoid the 1.5 million new phishing sites that are created each month?[3] In addition to regular security awareness training that explains how to pick a strong password, companies should amend their training to include phishing awareness.

Read more