Ransomware Defense

Ransomware is an incident pattern, not just an encryption program. Attackers may gain access, expand control, steal data, disable recovery options, and disrupt systems. Encryption can be one part of the event. Data theft and extortion can continue even when recovery copies work.

Ransomware defense therefore spans the full risk-management cycle. NIST's Ransomware Community Profile organizes the work across Govern, Identify, Protect, Detect, Respond, and Recover. CISA's StopRansomware Guide connects preparation and prevention with a response checklist.

The resilience model

Use six connected outcomes:

1. Govern. Define ransomware risk, decision authority, external contacts, communications, and supplier responsibilities.
2. Identify. Know critical services, assets, identities, data, dependencies, and recovery priorities.
3. Protect. Reduce initial access and privilege. Segment systems. Protect recovery infrastructure.
4. Detect. Watch for precursor activity, credential abuse, security-control tampering, unusual administration, data movement, and broad file changes.
5. Respond. Isolate affected systems, scope the compromise, preserve evidence, coordinate decisions, and contain attacker access.
6. Recover. Rebuild from trusted sources, restore in business order, validate integrity, and monitor for recurrence.

One weak link can undermine the rest. A backup does not help if the attacker can delete it. Strong endpoint protection does not repair an untested recovery process.