Ransomware protection for businesses in Cameroon: 10 controls

One Saturday evening, someone logs in to the company server through the remote access opened one day so a contractor could fix a computer, and never closed. The password was simple. For ten days, nothing shows. Then, one Sunday at 2 am, everything is encrypted: the computers, the file server and the backup drive left plugged in “so nobody forgets”. On Monday morning, the accountant finds a message on her screen demanding a ransom.

There is nothing unusual about this scenario. It is typical: the attacker did not need anything spectacular, just a few doors left open. The good news is that most of those doors can be closed with well-known, affordable measures you can verify.

This guide explains how an attack unfolds, which controls to put in place first, and what to do if it happens anyway.

What is ransomware?

Ransomware is malicious software that encrypts an organisation’s data to make it unreadable, then demands a ransom in exchange for the key. Many groups also steal the data before encrypting it, and threaten to publish it if the ransom is not paid.

So the damage is not limited to lost files. The business stops: no invoicing, no till, no access to customer records, sometimes for days.

How does an attack unfold?

An attack is rarely instantaneous. It goes through stages, and each one is a chance to stop it.

1. Getting in. A booby-trapped email opened by an employee, a weak or stolen password on remote access exposed to the Internet, a firewall or VPN that has not been updated, or pirated software installed on a computer.
2. Exploring. The attacker maps the network: servers, file shares, accounts, backups.
3. Taking control. They try to obtain an administrator account, which opens every door.
4. Stealing data. They copy anything valuable, so they can threaten to publish it.
5. Destroying backups. They delete or encrypt every backup they can reach.
6. Encrypting, ideally when nobody is watching: at night, at the weekend, on a public holiday.
7. Demanding the ransom, with a deadline to add pressure.

Days, sometimes weeks, can pass between getting in and encrypting. That is why backups must be kept long enough, and why weak signals matter.

What are the 10 controls, in order of priority?

1. Offline or immutable backups, tested. This is what lets you restart without paying. A backup the attacker can reach does not protect you.
2. Multi-factor authentication wherever possible: email, remote access, administrator accounts, the backup console, online banking.
3. Close exposed remote access. No remote desktop open directly to the Internet; go through a VPN protected by multi-factor authentication.
4. Update, starting with equipment exposed to the Internet: firewall, VPN, router, then operating systems and software on every computer.
5. Separate administrator accounts. Day-to-day work happens on an ordinary account, and the administrator account is used only to administer. Everyone has only the rights they need.
6. Protect every computer and server with antivirus or an endpoint detection and response (EDR) tool, monitored and up to date.
7. Install only legitimate software. Pirated software is a classic way in.
8. Train the team on phishing, and set one simple rule: any unusual request, especially for a payment, is checked by phone. Our guide to WhatsApp and Mobile Money scams gives scenarios to act out with the team.
9. Segment the network. Cameras, guest Wi-Fi, tills and servers should not all be able to see one another.
10. Prepare the response: a written plan, printed contacts, and activity logs kept so you can understand what happened.

The #StopRansomware Guide from CISA, the United States cybersecurity agency, sets out these controls in detail for technical teams.

Backups: what is the 3-2-1-1-0 rule?

Against ransomware, backup is your last line of defence. The 3-2-1-1-0 rule sums up what it has to be:

• 3 copies of your data;
• on 2 different media;
• with 1 off site;
• and 1 offline or immutable, which nobody can change or delete during its retention period;
• with 0 errors in the latest restore test.

Three precautions specific to ransomware:

1. The account that writes backups must not be able to delete them. Otherwise an attacker who steals it wipes everything.
2. Retention must be long enough to cover an intrusion discovered late.
3. Restores must be tested, timed and recorded, at least every quarter.

Our backup and disaster recovery guide explains the method in detail, from setting recovery objectives to testing a restore.

What should you do in the first 24 hours after an attack?

In the first hour

1. Isolate the affected machines: unplug the network cable and switch off Wi-Fi. If the attack is spreading, cut the network’s Internet connection.
2. Do not switch the affected machines off unless you cannot disconnect them from the network. Shutting them down can erase traces that help explain the attack; a machine you cannot isolate, however, should be switched off to stop the spread.
3. Unplug any backups still connected to the network, so they are not destroyed.
4. Call your IT provider by phone, not through company email, which the attacker may control.

In the hours that follow

1. Keep the evidence: a photo of the ransom note, activity logs, samples of encrypted files. Do not reinstall anything yet.
2. Do not pay, and do not negotiate on your own.
3. Change the essential passwords from a clean device: email, banking, Mobile Money, administrator accounts.
4. Assess the damage: which machines, which data, which backups are intact.
5. Keep the business running in degraded mode: paper receipts, a sales book, to be entered later.

Before the end of the day

1. File a complaint with the police or the gendarmerie, before reinstalling the machines.
2. Report the incident to ANTIC’s CIRT, the incident response team of Cameroon’s National Agency for Information and Communication Technologies, which also publishes security alerts: through its online form for system compromise, or on the toll-free 8202. Do not delete the logs or the ransom note: they are evidence.
3. Inform the people affected if customer or employee data may have been stolen, and find out what your obligations are.
4. Check No More Ransom, a project backed by Europol and the Dutch police, for a free decryption tool for the ransomware that hit you.

Only then comes rebuilding: find and close the way in, reinstall clean systems, restore from a backup taken before the intrusion, change every password, then bring services back gradually while watching them. Restoring too early often means opening the door to the attacker again.

How can Nematek help?

Our cybersecurity services start with an assessment of your real risks and a prioritised improvement plan, then cover hardening, endpoint protection, access and administrator-account management, vulnerability management and sound backup practice, without forcing an oversized security stack on you.

Nematek One Secure brings together a security assessment, an inventory of accounts and devices, multi-factor authentication, endpoint protection based on the selected solution, backup with restore testing, and incident support according to the plan chosen. Third-party licences, hardware and storage are priced separately. To take stock, describe your situation in a free assessment request.