IT glossary
Ransomware
Ransomware is software that encrypts an organization's files so they cannot be opened, after which whoever placed it there asks for payment to unlock them.
It is worth being plain about the sequence, because it is less dramatic than the name suggests. Someone gets access, usually a stolen password or an unpatched system exposed to the internet. They look around, often for days. They find the backups first and try to damage them. Then, typically at a weekend, the encryption runs.
Understanding the order matters, because almost every useful defence sits in the quiet middle part, not at the end.
Why it matters to you
Not because of what it does to files, but because of what it does to time. The organizations that recover well are the ones that already knew how long a restore takes, had a copy the attacker could not reach, and had a phone list that did not live on the network that just went down.
The ones that struggle are rarely the ones with the weakest security. They are the ones who had backups nobody had tested.
What actually reduces the damage
- Multi-factor authentication, because most access starts with a working password
- EDR, endpoint detection and response, which can isolate a machine on behaviour rather than waiting for a match
- An offline or immutable backup copy: one that cannot be deleted by an account that has been taken over
- A restore you have timed, on real data, in the last year
- Patching on anything reachable from the internet
About paying
This is a business and legal decision, not a technical one, and it belongs with your leadership, your insurer and your lawyer rather than with your IT provider. Two facts are useful going in: payment buys a decryption tool of variable quality, not a fast recovery, and it does nothing about data that has already been copied. Whether payment is even permitted can depend on who is being paid. Have the conversation before you need it.
The most common misconception
That this is only a problem for large organizations. Most of it is not targeted at anyone in particular, it finds whatever is reachable. Which is oddly reassuring, because it means ordinary maintenance, done consistently, removes you from most of it.