The highly disruptive and damaging consequences of malware (short for Malicious Software) are well known. The world’s four largest shipping companies— AP Moller – Maersk A/S, Mediterranean Shipping Company, CMA CGM, and COSCO—were all infected by ransomware over the last five years.

More commonly known as “cyber attacks”, the use of this ever-evolving form of malware is designed to compromise systems and/or steal data by encrypting files, rendering them and the systems that rely on them unusable. By the time you notice anything is wrong, your data has been taken hostage and a ransom has been demanded, hence the term ransomware.

Ransomware is not a new type of malware in fact it has been around for over 15 years.  It is only in the past 5 years that ransomware has started to become a mainstream industry, replacing the hacker’s favored use of infection via viruses, worms, trojan horses, key loggers or spyware. It has claimed the top spot for good reason; ransomware has monetized the use of malware.

Prior to 2015, most ransomware attacks were specifically targeted and developed by a single party. The first reported instance of Ransomware-As-A-Service (RAAS) appeared around 2015 and continues to change the security landscape to this day.

RAAS allows anyone to acquire ransomware software and use it to infect a targeted system with the agreement that a portion of the paid ransom be commissioned to the person providing the RAAS.  Hypothetically, this would enable a school child to download and install ransomware in his school or an employee now has the relatively easy opportunity to hold a corporate network hostage.

This means that RAAS is of significant concern to all companies, and this concern should not be limited to IT departments.

Ransomware used to cost hundreds or thousands of dollars to restore infected systems. These days, it is not unheard of for ransoms to be in the hundreds of thousands to millions of dollars. In 2020, a financial firm paid out a $40 million ransom.

Around the year 2017, there was much concern held about a malicious software called “WannaCry”.  This was for good reason as it was a ransomware package being spread throughout the Internet using the same techniques as a worm virus.  It was reported that the WannaCry ransomware attacks cost an average of $4 billion in losses.

Even outside of paying a ransom fee, the fallout costs from a malware attack can be huge. The infection of the world’s largest shipping firm, AP Moller – Maersk A/S by a piece of notorious malware known as Petya in 2017 cost them around $300 million in lost revenue, information technology restoration, and operational costs.

Ransomware is now firmly established as a big-money opportunity with off-the-shelf capability to attack targets without requiring any knowledge of information systems.  Reportedly, some RAAS offerings have become so structured that the service includes a negotiator to act on behalf of the attacker to work out the best terms.

Furthermore, there are reports that individuals are being recruited to carry out the infection into a corporate network.  Just imagine, you have a bad day at work and vent your frustration on social media; a day later you are offered US$5,000 to simply click on a URL while at work and install the software.  For a couple minutes effort and several thousand dollars in bitcoin later, your employer network is locked up and you get to go home early for the day.  This scenario may sound fanciful, but it is becoming a more frequent reality.

So, what’s the solution? A good defense strategy is to have a regular maintenance schedule for all your systems including anything that connects to the internet or network (wired or wirelessly), anti-virus/malware software installed on all information systems, and defensive appliances within your network to prevent and/or detect attacks.  Better defense against malware attacks comes via regular education throughout your organization and to promote an understanding of what threats exist, how they are employed and the responsibility to prevent them.

With billions of dollars being made, the authors and users of ransomware are being incentivized and becoming better equipped to improve the quality of their software and tactics.  Everyone is on the frontline and the hero can now be defined as the one who reports the suspicious message on LinkedIn and prevents a multi-million-dollar ransom situation.  Security is no longer a position nor department; it is a culture to be encouraged and rewarded.

For our customers, your data is safe in our hands. Our software products have the strictest security and compliance controls, as detailed below. You can find out more here.

• Encryption

All sensitive Q88 database information is encrypted. During transmission, Q88 uses the TLS encryption protocol, the same adopted for online banking. Electronic ‘certificates’ encode all communications using a 2048-bit RSA key and 256-bit encryption.

• Privacy and protection of customers’ hosted data

Hosting Q88 in London means that the European Union General Data Protection Regulation governs the data stored by our clients. In creating a robust standard for the protection of personal identifiable information, the GDPR creates a framework that strengthens business IT security.

Should the UK exit the EU, the UK’s regulatory controls will be equivalent or exceed the GDPR standard.

• EU data processed by US companies

The EU-US Privacy Shield decision was adopted on 12 July 2016 and the Privacy Shield framework became operational on 1 August 2016. The Swiss-U.S. Privacy Shield applies to Switzerland.

These frameworks are designed to provide companies on both sides of the Atlantic with a mechanism to comply with data protection requirements when transferring personal data from the European Union and Switzerland to the United States in support of transatlantic commerce.

These frameworks protect the fundamental rights of anyone in the EU and Switzerland whose personal data is transferred to the United States for commercial purposes. The framework also brings legal clarity for businesses relying on transatlantic data transfers.

• What about Rackspace and access to our data?

Rackspace has no knowledge of the data (including any personal data) that Q88 clients store or is otherwise processed on its infrastructure.