What is Ransomware?
Ransomware is malware that attacks a computer, encrypts data and demands a fee to be decrypted. The goal is to deny access to business-critical systems and disrupt operations.
Cybercriminals tend to target companies that have a low cybersecurity profile or do not have dedicated teams of IT professionals who know what ransomware is and how to stop it. SMBs are often a favorite target for ransomware, because they have more to lose from an interrupted workflow than larger organizations.
While some businesses and organizations may be willing to pay the ransom, others find it more economical to buy time by rerouting critical infrastructure or restoring backups. In the aftermath of an attack, it’s critical for organizations to report ransomware to law enforcement, explains Microsoft Incident Response. Not only does this help prevent future ransomware incidents, but it can also help identify the criminals involved and bring them to justice.
A ransomware attack can have severe consequences for society. Healthcare providers and other critical services face unique risk, but attacks can cause disruption across sectors. The Colonial Pipeline incident in 2021 is a case study in how ransomware can compromise operational technology (OT) systems, leading to disruptions of vital infrastructure like fuel pipelines and transportation.
The best way to defend against ransomware is to protect systems with comprehensive security software and keep those systems up to date. It is also a good idea to back up critical systems regularly and to use backup systems that do not allow direct access to the original data. Additionally, it’s important to understand that even if the attacker provides a decryption key, it’s not guaranteed to work. That’s because ransomware creators aren’t in the file recovery business; they’re in the moneymaking business.