Defending Against Ransomware

Defense is presented as the most effective option against ransomware because once users encounter ransom notes or discover encrypted files, meaningful damage is typically already done. Effective ransomware resistance requires both organizational coordination and technical implementation, organized around three phases: prepare, prevent, and recover. Preparation centers on user training plus developing and testing procedures so responses are fast and consistent under pressure. Prevention depends on layered technical controls that reduce the likelihood of malicious payloads reaching endpoints and limit what malware can do if it executes. Recovery becomes critical when prevention fails, and success hinges on technical capabilities paired with well-executed, pre-tested operational procedures.

On the organizational side, communication is positioned as essential: users need regular education, while executives must be kept informed about risk and mitigation plans. Tested, ready-to-run procedures reduce losses and downtime. Key organizational tasks include maintaining offline backups to prevent ransomware from encrypting accessible backup repositories, running security awareness and anti-phishing training, disabling Office macros by policy where feasible (and limiting macro enablement to truly necessary cases), and establishing automated “sterilize and restore” routines to rapidly wipe and rebuild systems, applications, and user data after compromise.

Technically, the recommended approach begins at the edge with web and email filtering that scans and detonates suspicious content, blocks malicious sites and malvertising, and uses real-time threat intelligence updates. Because some malware will evade filters, comprehensive endpoint protection is required, including modern anti-malware that relies on behavioral and heuristic detection rather than signatures alone, rapid patching to close known vulnerabilities, application whitelisting to stop just-in-time malware assembly, and privilege management enforcing least privilege to deny malware advanced operating system functions.

• Offline data backups help prevent information loss when ransomware encrypts data.
• Some ransomware attacks have encrypted online backups, preventing victims from restoring.
• Ransomware commonly arrives through phishing email attachments that leverage Office document macros and PowerShell.
• Phishing emails can deliver ransomware via links to infected sites.
• Drive-by downloads and malvertising are listed as ransomware delivery mechanisms.
• Signature-based antivirus is described as largely ineffective against polymorphic malware that changes payload characteristics.
• Behavioral endpoint detection can flag code that encrypts or changes extensions on massive numbers of files.
• Malicious code may attempt multiple copy-on-write operations as part of ransomware activity.
• Malware may delete volume shadow copies to hinder recovery.
• Many ransomware variants exploit known vulnerabilities for which patches exist.

• “Defense is still the best option.”
• “To combat ransomware, we must conceptually focus on three major courses of action: prepare, prevent, and recover.”
• “On the organizational side, communication is key, and involves regularly educating users as well as informing executives on risks and mitigation plans.”
• “Having tested procedures ready-to-go in the event of an attack will help reduce losses.”
• “Preventing malicious payloads from reaching the desktops and inboxes of users should be the goal.”
• “However, malware can slip by. This is why Endpoint Protection is necessary.”
• “Reduce the attack surface by ensuring that vulnerabilities within OSes and applications are mitigated as quickly as possible with rapid and automatic patching.”
• “Many forms of ransomware exploit known vulnerabilities for which patches are available.”
• “Prevent malware from using common desktop applications to perform Just-in-Time malware assembly and encryption.”
• “Enforce least privilege via policy for users and deny malware access to advanced OS functions.”