What Is Ransomware? Ways to Protect Yourself

01How Does a Ransomware Attack Happen?

One morning you arrive at the office; the file extensions have changed, nothing will open, and a note sits on the desktop: to get your data back, you are asked to pay in cryptocurrency within a set time. This is the final stage of a ransomware attack; the attacker has usually been in the system for days, even weeks.

Modern ransomware groups don't stop at encryption. Before encrypting, they copy sensitive data and threaten to publish it if you don't pay. This is called double extortion, and it aims to put pressure even on businesses that can recover from a backup.

The targets are not only large companies. Small and medium-sized businesses become easy targets in automated scans because their defenses are weaker. Whether it is an accounting office, a clinic, a hotel or a workshop, anyone with data is a potential target.

02How Does Ransomware Spread?

Ransomware gets in through a few familiar doors. Knowing these doors shows you where to focus your defenses.

03Warning Signs Before an Attack

Before they start encrypting, attackers move around the network, raise their privileges and try to find the backups. This preparation period often leaves traces you can notice. Catching them early gives you a chance to stop the attack before encryption begins.

When you see any of the signs below, don't write it off as an ordinary glitch; investigate it with your IT person. Unusual activity outside working hours in particular should be taken seriously.

• A new administrator account you don't recognize, or users whose permissions have changed
• Remote desktop logins during the night
• Security software switching itself off
• Backup jobs being deleted or failing repeatedly
• An unusually large outbound data transfer on the network and slowing servers

04Files Are Encrypted: First Steps

The steps you take in the first hours after seeing a “files are encrypted” note determine the extent of the damage. Panicking and reformatting the computer, or paying right away, is often the worst option.

1. Disconnect the affected devices from the network: unplug the network cable, turn off Wi-Fi; consult an expert before powering the device off
2. Immediately disconnect any attached external drives and network shares
3. Photograph the ransom note and the screen, and don't delete any files
4. Notify your IT person or the company that supports you
5. Change the passwords of administrator accounts and critical systems from a clean device
6. Check the state of your backups; isolate the backup system from the attacker's access
7. If personal data was affected, review your legal notification obligations with your legal advisor

05Should You Pay the Ransom?

The general advice of security agencies is not to pay the ransom. Paying does not guarantee your data will be returned; the decryption tool may not work, the data may still be published, and the business may be marked as one that “pays” for the next attack.

The decision to pay is a heavy one that must be made by weighing business continuity, legal obligations and the state of your backups together. Don't make it alone; talk to your legal advisor and to experts experienced in incident response.

Free decryption tools have been released for some ransomware families. No More Ransom, a joint initiative of European law enforcement and security firms, helps you identify the strain that infected you and find a free tool if one exists.

06Your Strongest Shield: Backups

The most effective measure against ransomware is a working backup the attacker can't reach. For a business that can recover from a clean backup, an attack stops being a disaster and becomes a manageable outage.

But not every backup does this job. An external drive or network share that stays permanently connected is encrypted along with the original files. Cloud folders that sync can carry encrypted files up to the cloud, and on a service without version history, rolling back may not be possible. We covered the strengths and weaknesses of cloud storage in this respect in our what is cloud computing article.

• The 3-2-1 rule: three copies, two media, one off-site location
• At least one of the copies must be offline or immutable
• The backup system's administrator password should be kept separate from the accounts on the main network
• Restores should be tested regularly and the time they take measured

07Preventive Security Measures

A backup rescues you after an attack; the measures below reduce the chance of an attack happening in the first place. None of them is enough on its own, but applied together they form a layered defense.

Technical Measures

• Automatic updates for the operating system, browser, VPN and all software
• Not exposing remote desktop access directly to the internet
• Two-step verification on email, VPN and administrator accounts
• Up-to-date security software and an email attachment filter
• Keeping macros in office documents turned off by default

Administrative Measures

• Not giving users administrator rights for everyday work
• Giving each employee access only to the folders their job requires
• Shutting off access for people who leave on the same day
• Short, regular security awareness training
• A written incident response plan and a list of people to call in an emergency

08Servers and Websites

Ransomware can target not only office computers but also servers and websites. When a system that holds reservations, orders or customer records goes down, the loss is far greater than the encrypted files themselves. In a hotel software system or an e-commerce platform that takes a high volume of orders, for example, even a few hours of downtime means a direct loss of revenue.

In custom-built software solutions, role-based permissions, activity logs and regular backups of the database to a separate environment can be planned from the start. For live websites, keeping the server software up to date, monitoring backups and noticing unusual behavior are carried out through regular maintenance under speed and performance management.

If you have noticed malicious code or unexpected changes on your site, we walked through the steps to take in our hacked website guide.