Ransomware, and What Actually Stops It

Encryption is the last step. By the time the screens change, the attacker has usually been inside for a while. The order runs roughly like this: get in, look around quietly, take the credentials that matter, find and destroy the backups, copy out anything worth selling, then encrypt everything at once, normally on a Friday night or over a holiday.

The gap between getting in and encrypting is your whole opportunity. Everything useful you can do during an attack sits inside that window, and everything else useful was done months earlier.

The way in is rarely exotic. A password that was reused and turned up in somebody else's breach. Remote access published to the internet without a second factor. An unpatched appliance at the edge of the network. Somebody clicking something. Those are the routes that keep turning up.

Note the copy out step, because it changes what a backup is worth. Crews take your data before they encrypt it, so a perfect restore leaves you running again with a demand still attached to publishing the files. Backups get your business back. They do nothing about the copy that already left.

Start at the edge, because that is where the automated part of the attack lives. Everything of yours reachable from the internet belongs on a list somebody maintains: remote access gateways, VPN appliances, firewalls, mail gateways, file transfer tools, remote desktop, and the management interface that was opened for a supplier and never closed.

Ask two questions of each entry. Does it need to be reachable from everywhere, and is it patched. Edge devices get attacked faster than anything else you own because they are findable, and a scanner sweeping the internet has no idea how small your company is.

Then identity. Multi factor on every remote entry point without exception, including the administrative console of every cloud platform you use. Remote desktop published straight to the internet should not exist anywhere in your estate. Where a supplier needs access, give them a named account behind the same controls as your own staff.

Then email and browsing, which is where the human route runs. Block the file types that carry payloads, strip macros from documents that arrive from outside, and stop staff being local administrators on their own machines. That last one is the least popular item here and it does more work than the rest of the paragraph.

Ransomware becomes a company wide event because somebody with rights over everything happened to be signed in on a machine the attacker reached. Remove that and the same intrusion stays a problem with one laptop.

The rules are short and the implementation is a project. Nobody uses an account with administrative rights for email or browsing. Administrators get a second account for administrative work, and that account has no mailbox. Rights across the whole directory belong to almost nobody, and are used from a dedicated machine rather than from a laptop that also opens attachments.

Local administrator passwords on laptops are the quiet one. Where every machine shares the same local password, an attacker who takes one machine has taken all of them. Unique passwords per machine, rotated automatically and stored centrally, closes that path completely. Most platforms include it, and turning it on removes an entire technique.

Service accounts deserve their own pass. They tend to be old, over privileged, and running on a password that has not changed since the software was installed. Cut what they can reach, deny them interactive sign in, and start by finding out which ones exist.

On a flat network, one compromised laptop can reach every server, every other laptop and the backup appliance. That is a design decision, and in most companies it was made by nobody in particular over several years of adding things.

The first useful split is between workstations and servers, with only the ports that are genuinely needed allowed across. The second is workstation to workstation. There is almost never a business reason for one laptop to open a file share on another, and blocking it removes the mechanism the spread normally uses.

Then isolate what would hurt most. Backup infrastructure on its own segment with its own credentials. Finance systems separated from the general estate. Machines on the factory floor or in the clinic kept away from the office network entirely, since those are frequently the ones that cannot be patched at all.

You do not need a perfect design to get the benefit. A few well chosen boundaries change the shape of a bad day, and most of them can be built with equipment you already own and a quiet afternoon.

Crews look for the backup system before they encrypt anything, because destroying it converts a technical problem into a commercial negotiation. Treat the backup console as a target in its own right rather than as a piece of housekeeping.

In practice that means at least one copy that cannot be altered or deleted for the whole of its retention period, credentials for the backup platform that are separate from your normal directory, multi factor on the console, and no route from a compromised workstation to the backup storage.

Then the part everybody skips. Restore something, on the clock, into a separate environment, and get a person who uses that system every day to confirm the data looks right. Until then a backup is a belief rather than a capability. The week you need a recovery in hours is a poor time to discover it takes days.

Keep enough history to go back past the intrusion. Attackers sit inside for a while before they act, so a short retention window can leave you holding nothing but clean looking copies of an environment that was already compromised when they were taken.

The days between the first foothold and the encryption are noisy if anyone is listening. New administrative accounts appear. Security software gets disabled on a server. A credential dumping tool runs. Large volumes of data leave the network at an odd hour. Backup jobs start failing for no obvious reason.

Alert on those things specifically instead of hoping somebody reads a dashboard. A short list of high confidence alerts that reach a human out of hours is worth more than a long list that fills a queue nobody works through.

Endpoint detection that can isolate a machine by itself is worth the money for most businesses, because the response has to be faster than a person can be at two in the morning. Check that the alerts actually reach somebody and that the somebody is allowed to act without waiting for approval.

Watch the backup system's own alerts hardest of all. A retention policy deleted, a job disabled, an unexpected sign in to the console: any of those in the middle of the night is an incident until somebody proves otherwise.

Nobody pays because they are careless. They pay because the alternative is a business that has stopped, staff with nothing to do, and customers hearing nothing for weeks. It is a real decision under real pressure and it deserves a straight answer rather than a slogan.

The practical problems come first. A decryption tool is software written by criminals. It is often slow, often partial, and sometimes damages what it touches. You still have to rebuild afterwards, because the way in is still open and their tooling is still on your machines. Paying does not replace the recovery. It sits on top of it.

Then the part that cannot be checked. A promise to delete stolen data comes from a party whose entire business is dishonesty, and there is no way for you to verify it. Companies that pay are frequently approached again, sometimes by the same crew and sometimes by whoever bought the access from them afterwards.

There is legal exposure too. A payment can end up with a sanctioned entity, which turns a bad week into a different category of problem, so your lawyer and your insurer both belong in that conversation. Settle the policy now, while everything is calm, with the board present. A decision taken at three in the morning by an exhausted director is not really a decision.

Take local administrator rights off the accounts people read email with, and put multi factor on every remote entry point. Together those close the routes that keep turning up in real cases, and neither one needs a purchase order.

List everything of yours facing the internet, patch it, and keep the list current afterwards. Put the backup platform behind its own credentials and make at least one copy immutable.

Then run a restore. Pick the system the business could least do without, restore it into a separate environment, time the whole thing from the moment somebody decided to start, and write the elapsed time down. Whatever it says, it is now a fact rather than an assumption, and it belongs in front of the person who signs off the budget. The longer list is all worth doing eventually. Do these first, because they change the outcome rather than the paperwork.