Ransomware Protection for Architecture and Engineering Firms
Updated: 18 hours ago
Short answer: Ransomware protection for an architecture or engineering firm has three parts. First, close the common ways attackers get in: stolen passwords, phishing and exposed remote access. Second, keep backups of your project files that ransomware can't reach, and test that you can restore them. Third, write down who does what in the first hour. CISA's #StopRansomware Guide recommends the same core steps.
Design firms are a good target for ransomware. Active projects run on deadlines, files are large and shared widely, and a locked project server stops billable work at once. The good news is that the controls that matter most are well known and fit a small firm.
Why do attackers go after architecture and engineering firms?
Deadlines create pressure to pay. A firm days from a submittal is more likely to feel it has no choice.
Project files are valuable to the client too. Attackers often steal data before encrypting it, then threaten to leak it.
Lots of outside access. Consultants, contractors and remote staff all need to reach files, and every remote access path is a possible way in.
Big files push people to workarounds. Personal cloud accounts and old remote desktop setups are common in firms fighting slow file access.
How does ransomware usually get into a design firm?
CISA's #StopRansomware Guide lists the common initial access routes and what to do about each:
Compromised credentials. CISA recommends phishing-resistant MFA for all services, especially email, VPNs and accounts that reach critical systems.
Exposed remote access. CISA says to close unused Remote Desktop Protocol (RDP) ports, put MFA on remote access and VPNs, and keep VPNs and network devices patched.
Phishing. Train staff to spot it, filter email, and make it easy to report a suspicious message.
Unpatched internet-facing systems. Patch firewalls, VPNs and anything reachable from the internet first.
How should a design firm back up project files against ransomware?
Backups are what let you recover without paying, but only if ransomware can't reach them too. CISA recommends offline, encrypted backups of critical data, and says to regularly test the availability and integrity of backups in a disaster recovery scenario.
For an A/E firm that means:
Back up the project server, cloud storage and Microsoft 365 separately. Cloud sync isn't a backup. If files are encrypted, the encrypted versions sync too. Read more in Does Microsoft 365 back up your data?
Keep at least one copy offline or immutable, and protect it with separate credentials from your everyday admin accounts.
Include the things you'd need to rebuild, such as CAD and BIM licensing details, templates, plot styles and standards libraries, not just project folders.
Test restores of real project folders on a schedule, and write down what worked and what didn't.
For a broader look at recovery options, see our disaster recovery solutions guide.
What should happen in the first hour of a ransomware attack?
CISA recommends a written incident response plan, kept in hard copy and offline, that covers ransomware and data extortion. For a small design firm, that plan should answer:
Who isolates affected machines, and how (unplug from the network rather than power off).
Who calls whom: your IT provider, your cyber insurer and your attorney, in the order your policy requires.
How you reach staff and clients if email is down.
Who decides what to tell clients whose project files may be involved.
Where the offline copy of the plan and contact list lives.
You can also report the incident to the FBI's Internet Crime Complaint Center (IC3). Our post on the first hour of a cyberattack walks through how this plays out with and without a plan.
How does 24uNet help protect A/E firms from ransomware?
24uNet works with engineering firms and architecture firms in the Denver area and Bryan–College Station. Our Security Baseline puts these controls in writing: MFA, patching, backups you can restore, restore testing, and a written incident plan, reviewed with you on a schedule. It's built to support the questions cyber insurers and clients ask. To start with remote access and the firewall, ask about a network security review. For contracts and file handling, see how to protect CAD and design files before you sign.
FAQ
What is the single most important ransomware control for a small design firm?
There isn't just one, but MFA on email and remote access, plus backups ransomware can't reach that you've actually test-restored, cover the most common ways firms get hurt.
Is cloud storage enough to protect us from ransomware?
No. Sync services copy encrypted files just like good ones. You need a separate backup, with at least one offline or immutable copy.
How often should we test restoring project files?
On a regular schedule your team can keep up, and after major changes to your servers or storage. Restore real project folders, not just a test file, and write down the results.
Should we pay the ransom?
That's a business and legal decision to make with your insurer and attorney. The goal of preparation is to make recovery possible without paying.
Who should we report a ransomware attack to?
Follow your incident plan and insurance policy, and consider reporting it to the FBI's IC3 at ic3.gov. Your attorney can advise on any client or regulatory notice duties.
Talk to 24uNet about ransomware readiness
Want to know whether your firm could restore a project server after a ransomware attack? Call us at Denver (303) 468-5515 or College Station (979) 256-5100, email sales@24unet.com, or book a network security review.
Related reading: How Cybersecurity Technology Solves the Top 3 Pain Points for Architecture Firms; How Cybersecurity Technology Solves the Top 3 Pain Points for Engineering Firms.
Sources: CISA, #StopRansomware Guide: https://www.cisa.gov/stopransomware/ransomware-guide · FBI Internet Crime Complaint Center: https://www.ic3.gov
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. CMMC-AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments