Treat unexpected invoices, parcel notices and scans as suspect, never enable content in an emailed document, and keep at least one backup that is disconnected from the office computers, with the website's copies stored separately.

An invoice nobody was expecting

The email looks like routine paperwork. An invoice attached for payment, a parcel that could not be delivered, a document scanned on the office copier.

Since the start of the year a great many of these have carried ransomware: a program that encrypts the files on a computer and leaves a note demanding payment for the key.

They are aimed at exactly the people who open invoices for a living, which in a small business means the owner, the bookkeeper or whoever answers the office email.

And the damage rarely stops at one computer.

How the attachment works

The attachment is usually a Word document or a zip file. The document opens to a page of garbled text, with a line asking you to enable content so that it displays properly.

Enabling it runs a small program hidden in the document, which downloads the ransomware and starts it. The zip version contains a script that does the same when double-clicked.

Nothing visible happens at first. Files are encrypted in the background, and the first sign is often a colleague who cannot open a spreadsheet on the shared drive.

What it can reach

The fifth turns a bad day into a bad month. A backup drive that is always plugged in looks to the ransomware like any other drive, and is encrypted along with everything it was meant to protect.

Backups that are not always connected

The answer is a backup the ransomware cannot see at the moment it runs.

The simplest version is two external drives used in turn: one is connected for the backup, then unplugged and taken off the premises, while the other comes back. An encrypted office still has last week's drive in someone's home.

An online backup service that keeps earlier versions of each file does the same job, provided it keeps those versions long enough to reach back before the infection.

Whichever you use, test a restore. Until a file has actually come back from it, a backup is an assumption.

Habits that stop most of these

Never enable content in a document that arrived by email unless you were expecting it and have confirmed it with the sender. Genuine invoices rarely need it.

Check unexpected invoices by phone, using a number you already have rather than one in the email. Parcel notices from a carrier you were not expecting can simply be deleted.

Set Windows to show file extensions, so a file named invoice.pdf.js is visible for what it is. And keep Windows, Office and the browser updated, since some attacks rely on holes already fixed.

Staff should not use the computer signed in as administrators. That does not stop the files they can open being encrypted, but it limits what else a program can change.

A worked example

A pool and hot tub service company with four technicians runs its office from a room behind its small showroom, where an office manager handles scheduling, supplier invoices and calls.

In January an email arrived that looked like an invoice from a chemical supplier the company actually used. The attachment asked to enable content. The office manager clicked.

By the afternoon the shared drive held renamed, unreadable files: customer service histories, the spring opening schedule, quotes, and a folder of the website's files and logins the owner kept there.

The backup drive had been plugged into the office computer for two years. It was encrypted too.

What saved most of the work was a copy the bookkeeper took home each month for the accounts, three weeks old by then. The website itself sat untouched on its host's server.

The office rebuilt three weeks of changes from paper job sheets and email. A second backup drive now rotates off the premises, and the website's files and logins no longer live on the office drive.

Keep the website's copies apart

Ransomware on an office computer does not usually reach the website, which runs on a server somewhere else. But the website's copies often live in the office.

Old backups downloaded from the host, the design files, a spreadsheet of hosting and domain passwords: all sit on the same shared drive the ransomware is about to encrypt.

Keep website backups with the host and in a separate offsite copy, not on the office drive, and keep passwords in a password manager rather than a document.

Then an encrypted office does not also mean a business locked out of its own website.

If it happens

Disconnect the affected computer from the network straight away, by unplugging the cable or turning off the wireless, so it cannot reach more drives.

Do not plug in a backup drive to see whether it survived. Call whoever looks after your computers before doing anything else.

Paying is sometimes considered, but it comes with no guarantee of getting the files back, and a clean restore from a good backup makes the question unnecessary.

The counter-case

A business with one computer, and everything stored online in a service that keeps file versions, is less exposed than one with a shared drive. Its main risk is a version history that is too short.

Some offices already have a managed backup run by an IT provider, offsite and versioned. For them the work is checking that it covers everything and has been tested.

And no habit stops every attack. A convincing email will eventually be opened by someone.

Which is why the backup matters more than any rule about attachments: keep one copy that is never connected when the email arrives.

Before the next fake invoice

  1. Find every backup and check how it connects.
  2. Unplug the backup drive after each backup.
  3. Buy a second drive and rotate them offsite.
  4. Restore one file to prove the copy is usable.
  5. Move website files and passwords off the shared drive.
  6. Turn on file extensions in Windows.
  7. Tell staff never to enable content in emailed documents.

Step four is the one usually skipped. A backup that has never been restored can fail in a dozen quiet ways, and the day of an infection is the worst possible day to find out.

Keeping the office computers themselves patched is covered in old Internet Explorer stops getting fixes today.

Frequently asked questions

How does ransomware arrive by email?

Usually as a fake invoice, parcel notice or scanned document. The attached Word file asks you to enable content, or a zip file contains a script, and either starts the ransomware.

What files can ransomware encrypt?

Files on the infected computer, shared drives mapped to it, USB drives plugged in at the time, synced folders, and any backup drive left permanently connected.

Why is a connected backup drive a problem?

To the ransomware it is just another drive, so it is encrypted along with the files it was meant to protect. Unplug it after each backup.

What kind of backup survives ransomware?

One the ransomware cannot reach when it runs: drives rotated and kept offsite, or an online service that keeps earlier file versions for long enough.

Is the website at risk too?

The website usually runs elsewhere and is untouched, but its backups, design files and password lists often sit on the office drive. Keep them stored separately.

What should I do if it happens?

Disconnect the computer from the network immediately, do not plug in a backup drive to check it, and call whoever looks after your computers before doing anything else.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Backup drive always plugged in?

Tell us how the office and the website are backed up. We will find the gaps.

Start a Conversation