Internal audit’s guide to ransomware

Organizations have worked diligently for decades to protect data and information assets. Organizations deploy encryption technology, access limitations, and physically and logically segment valuable, sensitive, and proprietary data and information assets in an effort to keep bad actors from viewing, stealing, altering, or destroying it. However, at the same time, the bad actors have improved their craft; they infiltrate and steal these assets by using the same technology designed to protect it.

One of the primary methods used to extort and humiliate organizations throughout the globe is to impact technology using ransomware, which is designed to deny a user or an organization access to files on their computers and servers. By encrypting the files, and demanding a “ransom” payment for the decryption key, this malware places organizations in a position where paying the ransom may be the easiest way to regain access.

How can internal audit assist their organizations in defending themselves against bad actors who are using their own technology against them? How can organizations protect themselves?