What is ransomware and how do you defend against it and recover?

Ransomware encrypts an organisation's data and demands payment for the key. Modern operations use double extortion — exfiltrating data before encrypting, so refusing to pay still risks publication. That changes the calculus, because good backups no longer remove the leverage entirely.

The typical chain: initial access through phishing, an exposed remote access service, or an unpatched internet-facing system → credential theft and privilege escalation → lateral movement → deletion of backups and shadow copies → mass encryption.

Prevention, mapped to that chain:

• Close the entry points. MFA on all remote access, no RDP exposed to the internet, and prompt patching of internet-facing systems.
• Limit lateral movement. Network segmentation, no shared local administrator passwords, and tiered administrative accounts.
• Endpoint detection and response that can spot mass file modification and isolate the host automatically.
• Application allowlisting and macro restrictions.

Recovery — the decisive control:

• Immutable, offline, or air-gapped backups. Attackers specifically target backups first, so a backup reachable with the credentials they stole is worthless. This is the single most important defence.
• Tested restores with a known recovery time.
• An incident response plan that assumes systems are unavailable — including offline copies of the plan itself and out-of-band communication.

Note: On paying: law enforcement advises against it, roughly a third who pay do not recover all data, and payment may breach sanctions rules. It is a business and legal decision, not a technical one.