Ransomware readiness means isolating infected computers immediately, restoring from offline backups, and communicating through a practiced plan. Ransomware is malicious software that encrypts files or locks systems until victims pay for a key. Any group that relies on shared drives and email can lose both in one incident. Preparation keeps one infected laptop from becoming a network-wide outage.
Table of Contents
- How do you stop ransomware from spreading?
- How do you keep backups ransomware-proof?
- Who needs to know, and how do you reach them?
- Should you pay the ransom?
How do you stop ransomware from spreading?
Upon suspected ransomware, disconnect the infected system from all networks at once. Turn off Wi-Fi, Bluetooth, and other networking on the device. CISA and the FBI give this isolation step in their joint advisory on stopping ransomware spread.
Use segmentation to divide the network into smaller zones with separate access controls. That structure slows intruder movement between workstations, servers, and backups. CISA, NSA, the FBI, and MS-ISAC direct this containment approach in the #StopRansomware Guide.
How do you keep backups ransomware-proof?
Maintain offline, encrypted backups of critical data. Test backup and restoration procedures on a regular schedule. CISA gives this direction in its current StopRansomware guidance.
Attackers routinely locate and delete or encrypt accessible backups first. Online-only copies and mapped-drive copies often fail for that reason. CISA points to isolated, immutable copies plus tested restores as the practical fix.
- Keep at least one backup offline and disconnected from the network
- Lock copies so they cannot be changed or deleted for a set period
- Restore files to a test system on a schedule and record the result
Who needs to know, and how do you reach them?
Create, maintain, and exercise an incident response, resiliency, and communications plan before an attack. List roles, alternate contacts, and out-of-band channels that work when email is down. NIST gives this planning advice in its Ransomware Protection and Response project.
Report every incident once to the U.S. government through FBI IC3, CISA reporting, or the Secret Service. CISA runs a 24/7 center at [email protected] and (888) 282-0870. CISA lists these single-report options on its CISA reporting page.
Should you pay the ransom?
The FBI, CISA, and MS-ISAC do not encourage paying ransoms. Payment does not guarantee file recovery and may embolden further attacks. The agencies state this position in the FBI and CISA Rhysida advisory.
Report promptly even if you decide to pay. Fast reports help investigators share warning signs with other targets. Keep the payment decision separate from the duty to notify.
You Might Also Like
- Ransomware Recovery Plan: Backups, Rebuilding, and Notifications
- Ransomware Recovery Risk Guide: Data Exposed, Fraud, and Identity Theft
- Ransomware Payment Security Review: Entry Point, Impact, and Lessons