Ransomware is malicious software that encrypts a victim's files and demands payment for the key to unlock them. Many attacks now also involve stealing data and threatening to publish it. Anyone can be affected, from individuals to hospitals and city governments, and recovery can be costly and slow. A strong backup strategy is among the most effective ways to limit the damage.
How Ransomware Gets In
Common entry points include phishing emails with malicious links or attachments, stolen or weak passwords on remote access tools, unpatched software vulnerabilities and infected downloads. Once inside, attackers often spend time exploring the network before they encrypt files, which lets them reach shared drives and backups.
Why Backups Matter
If you have clean, recent copies of your data, you can restore systems without paying a ransom. Backups do not prevent an attack, but they greatly reduce its impact. Payment also carries no guarantee that files will be restored, and it may encourage further attacks.
The 3-2-1 Backup Rule
- 3 copies of important data, including the original.
- 2 different types of storage, such as an external drive and cloud storage.
- 1 copy offsite or offline, so it cannot be reached by malware that spreads across a network.
Make Backups Resilient
Attackers target backups, so keep at least one copy disconnected or protected with immutable storage that cannot be altered. Use separate credentials for backup systems and enable multi-factor authentication. Keep multiple versions so that you can roll back to a point before infection.
Test Your Restores
A backup is only useful if it works. Periodically test restoring files and, for organizations, entire systems. Document how long recovery takes so you can plan realistically.
Reduce the Chance of Infection
- Install security updates promptly on operating systems, browsers and applications.
- Use multi-factor authentication on email, remote access and administrative accounts.
- Limit administrative privileges to those who need them.
- Train users to recognize phishing.
If You Are Hit
Disconnect affected devices from the network, but do not turn off systems if guidance from your response team says otherwise. Contact your IT or security team, notify law enforcement such as the FBI or the Cybersecurity and Infrastructure Security Agency, and preserve evidence. Organizations should activate their incident response plan and contact their cyber insurer if they have one.
Prepare Before It Happens
The best time to prepare is before an incident. A written response plan, current backups and a clear list of contacts can mean the difference between a short disruption and weeks of lost work.
Comments are closed.