Ransomware is malicious software or an attack process that blocks access to data or systems, often by encrypting files or threatening to publish stolen information. Paying a ransom does not guarantee that data will be restored or deleted.
How incidents begin
Common entry points include phishing, stolen credentials, exposed remote access, unpatched software and compromised suppliers. Attackers may explore a network before disrupting systems.
Prevention
- Patch operating systems and applications.
- Use MFA for remote access and administrator accounts.
- Apply least-privilege permissions.
- Filter email and restrict risky attachments.
- Monitor endpoints and unusual activity.
- Train staff to report suspicious messages.
Build resilient backups
Keep isolated or immutable backups where possible. Set a schedule that matches acceptable data loss and test restoration regularly. Protect backup credentials separately.
During an incident
Follow the incident-response plan, contact security staff, isolate affected systems when instructed and preserve evidence. Seek qualified incident responders and relevant authorities.
FAQs
Does antivirus stop every attack?
No. It is one layer of a wider security programme.
Should victims pay?
There is no universal answer; payment does not guarantee recovery. Seek qualified guidance.