Cyberglossary Ransomware Guide

Ransomware is a kind of malicious software that encrypts computer systems' files to prevent users from accessing their data until a ransom is paid to the attacker. Ransomware has been on the rise: 68.5% of organizations worldwide suffered attacks in 2021.

There is no sign of ransomware attacks slowing down. In April 2022, energy company Oil India was hit by an attack, and the hackers demanded $7.5 million in exchange for returning control of their IT systems. Instead of instantly paying the ransom, Oil India called on local and international officials for assistance—suffering significant financial losses in the meantime.

When coupled with digital supply chain compromise and with remote or mobile workers accessing the network, ransomware attacks can come from anywhere. There are specific types of protection that minimize risk and reduce the impact of ransomware attacks at different layers including: 

• cloud-based security solutions such as SASE to protect off-network devices

• advanced endpoint security known as EDR (endpoint detection and response) solutions that can disrupt malware mid-attack

• network segmentation strategies including Zero Trust Access that restrict access to applications and resources based on policy and context

Along with multiple layers of protection, organizations need to make foundational changes to the frequency, location, and security of their data backups to effectively deal with the evolving and rapidly expanding risk of ransomware.