Ransomware

1. Introduction to Ransomware

Ransomware is a type of malicious software or criminal
activity designed to prevent access to systems or data and demand some form
of payment or other action from the victim.

Many ransomware incidents involve encryption of files or systems. Modern
incidents may also involve attempts to steal information and threaten its
release.

2. Ransomware and the CIA Triad

The CIA triad represents confidentiality, integrity and
availability.

• Confidentiality: Sensitive information may be stolen.
• Integrity: Files or systems may be altered or damaged.
• Availability: Legitimate users may lose access to data or services.

3. Encryption-Based Ransomware

Encryption-based ransomware attempts to make files inaccessible by encrypting
them.

The attacker may then demand payment in exchange for a claimed decryption
capability.

Organizations should not assume that payment guarantees recovery.

4. Data Extortion

Some ransomware incidents involve data theft before or alongside encryption.

The attacker may threaten to publish or misuse the stolen information.

This creates a confidentiality problem in addition to the availability
problem.

5. Double Extortion

The term double extortion is commonly used when an incident
combines data theft with encryption and threats to release the stolen data.

The defensive response should therefore address both system recovery and
potential data exposure.

6. Common Ransomware Entry Points

Ransomware can enter an environment through different routes, including:

• Phishing
• Compromised credentials
• Exposed remote-access services
• Unpatched vulnerabilities
• Malicious downloads
• Compromised third-party software
• Compromised devices

The exact entry point depends on the incident.

7. Phishing and Ransomware

Phishing can be used to obtain credentials or persuade users to interact with
malicious content.

Security awareness, email filtering, endpoint protection and MFA can help
reduce related risks.

8. Vulnerabilities and Ransomware

Unpatched vulnerabilities can provide attackers with opportunities to gain
unauthorized access.

A strong vulnerability-management program should identify, prioritize and
remediate important weaknesses.

9. Remote Access and Ransomware Risk

Remote-access services can become targets when they are exposed or poorly
secured.

Organizations should protect remote access with strong authentication,
MFA, appropriate access restrictions, monitoring and timely patching.

10. Ransomware and Compromised Accounts

An attacker who gains access to a legitimate account may use that access to
move through an environment.

Least privilege and strong identity controls can reduce the potential impact.

11. Lateral Movement

Lateral movement describes an attacker’s movement from one
system or account to another after gaining an initial foothold.

At a defensive level, organizations should monitor unusual authentication,
remote administration and access patterns.

12. Privilege Escalation

Attackers may attempt to obtain greater privileges than those associated with
their initial access.

Least privilege, patch management, application control and monitoring can
make unauthorized privilege expansion more difficult.

13. Why Backups Matter

Reliable backups are one of the most important ransomware defenses.

A backup strategy should consider:

• Regular backup schedules
• Multiple copies
• Different storage locations
• Access protection
• Offline or otherwise isolated copies where appropriate
• Backup monitoring
• Regular restoration testing

14. Backup Is Not the Same as Recovery

Having a backup does not automatically mean that an organization can recover
quickly.

Recovery also requires tested procedures, suitable infrastructure, correct
backup versions and people who know how to restore systems.

15. The 3-2-1 Backup Principle

The traditional 3-2-1 backup approach recommends keeping
multiple copies of important data across different storage media and locations,
including at least one copy that is isolated from the primary environment.

Organizations may adapt this principle to their own infrastructure and
recovery requirements.

16. Backup Immutability

An immutable backup is designed so that stored backup data cannot easily be
modified or deleted during its protected retention period.

Immutability can help reduce the risk that attackers destroy recovery data.

17. Ransomware and Segmentation

Network segmentation separates systems or groups of systems into controlled
security zones.

Good segmentation can limit how far an incident spreads.

For example, user workstations, servers, guest devices and critical systems
may be placed into appropriately controlled network segments.

18. Least Privilege

Least privilege limits users, applications and services to the permissions
they actually need.

If an account is compromised, fewer privileges can reduce the potential
impact.

19. Endpoint Protection

Endpoint security technologies can help detect suspicious behavior on
workstations and servers.

Depending on the environment, this may include antivirus, endpoint detection
and response, application control and host firewall capabilities.

20. Security Updates

Keeping operating systems, applications and security tools updated reduces
exposure to known vulnerabilities.

Patch management should prioritize systems according to risk and business
importance.

21. Email Security

Email security controls can help reduce ransomware delivery through
malicious messages.

Defensive controls may include:

• Spam filtering
• Malware scanning
• Attachment inspection
• URL protection
• Email authentication
• User awareness training

22. Common Indicators of Ransomware

Possible warning signs include:

• Large numbers of files being changed unexpectedly
• Unexpected file extensions
• Files becoming inaccessible
• Unusual disk activity
• Security tools being disabled unexpectedly
• Suspicious authentication activity
• Unexpected administrative activity
• Ransom notes appearing
• Unusual network traffic

A single indicator does not prove ransomware. Investigation requires context.

23. Ransom Notes

A ransom note is a message left by an attacker explaining that files or
systems have been affected and demanding some form of payment or action.

The presence of a ransom note should be treated as a potential security
incident requiring an established response process.

24. Ransomware Detection

Security teams may use multiple sources of information to identify suspicious
activity.

• Endpoint alerts
• File-system monitoring
• Authentication logs
• Network monitoring
• Firewall logs
• Server logs
• Identity-provider logs

25. Early Containment

When ransomware activity is suspected, rapid containment can help limit
additional damage.

Depending on the environment, defenders may:

• Isolate affected endpoints.
• Disconnect affected systems from relevant networks.
• Disable compromised accounts.
• Revoke suspicious sessions or credentials.
• Protect unaffected systems.
• Notify the incident-response team.

26. Evidence Preservation

Security teams should preserve relevant evidence when practical.

Potential evidence may include:

• System logs
• Authentication logs
• Endpoint alerts
• Network records
• File-system timestamps
• Backup records
• Relevant configuration information

27. Incident Response Lifecycle

1. Preparation
2. Identification
3. Containment
4. Eradication
5. Recovery
6. Lessons learned

The exact process may vary between organizations.

28. Eradication

Eradication focuses on removing the cause of the compromise and preventing
the threat from continuing.

This may include removing malicious software, closing exploited weaknesses,
resetting compromised credentials and rebuilding systems where necessary.

29. Recovery

Recovery involves safely returning affected services and systems to normal
operation.

Recovery should include validation that systems are secure enough to return
to service.

30. Restoring From Backups

Backups should be checked before restoration.

Defenders should consider:

• Whether the backup predates the compromise
• Whether the backup is complete
• Whether the backup itself is trustworthy
• Whether restoration procedures have been tested
• Whether restored systems require security updates

31. Do Not Assume the Earliest Backup Is Safe

If an attacker has remained in an environment for an extended period, older
backups may also contain compromised systems or data.

Organizations should investigate the incident timeline before selecting
recovery points.

32. Paying a Ransom

Organizations affected by ransomware may face difficult decisions regarding
ransom demands.

Payment does not guarantee data recovery or deletion of stolen information.

Organizations should consider legal requirements, insurance conditions,
business continuity, law-enforcement guidance and other relevant factors
according to their jurisdiction and policies.

33. Ransomware and Business Continuity

Business continuity planning prepares an organization to continue critical
operations during disruptions.

A ransomware plan should identify critical systems, recovery priorities,
responsibilities and communication procedures.

34. Recovery Time Objective

A Recovery Time Objective (RTO) represents the target amount
of time within which a service or system should be restored after disruption.

35. Recovery Point Objective

A Recovery Point Objective (RPO) represents the amount of
data loss an organization is prepared to tolerate, measured in time.

For example, an RPO of one hour means the organization is planning around the
possibility of losing up to approximately one hour of recent data, depending
on its backup architecture.

36. Ransomware and Cloud Services

Cloud services are not automatically immune to ransomware.

Compromised cloud identities, synchronized files and overly broad permissions
can create risks.

Cloud environments should therefore use strong identity controls, MFA,
least privilege, logging and suitable recovery mechanisms.

37. Ransomware and Shared Drives

Shared drives can increase the impact of a compromised account or workstation
if users have broad write permissions.

Access controls should be designed according to business requirements.

38. Security Monitoring

Monitoring can help detect suspicious activity before it becomes widespread.

Useful monitoring areas include:

• Authentication
• File activity
• Process behavior
• Network traffic
• Administrative activity
• Endpoint security alerts
• Backup status

39. Synthetic Ransomware Detection Example

The following PHP example demonstrates a simple defensive check using
fictional file metadata. It does not encrypt, modify or delete files.

<?php

$files = array(
	array(
		'name'    => 'report.docx',
		'changed' => 1,
	),
	array(
		'name'    => 'budget.xlsx',
		'changed' => 1,
	),
	array(
		'name'    => 'photo.jpg',
		'changed' => 0,
	),
);

$changed_files = 0;

foreach ( $files as $file ) {

	if ( ! empty( $file['changed'] ) ) {
		$changed_files++;
	}
}

if ( $changed_files >= 2 ) {
	echo 'Review required: multiple synthetic files changed.';
} else {
	echo 'No immediate synthetic ransomware indicator detected.';
}

40. Hash Verification

File hashes can be used to compare the contents of a file at different points
in time.

A hash does not prove that a file is safe, but it can help investigators
identify whether file contents have changed.

<?php

$file = __DIR__ . '/sample.txt';

if ( file_exists( $file ) ) {

	$hash = hash_file( 'sha256', $file );

	echo 'SHA-256: ' . htmlspecialchars(
		$hash,
		ENT_QUOTES,
		'UTF-8'
	);

} else {

	echo 'File not found.';
}

41. Authorized Classroom Exercise

Create a completely synthetic ransomware incident using dummy files in a
controlled laboratory environment.

1. Create a test directory.
2. Place non-sensitive dummy files inside it.
3. Create a fictional incident timeline.
4. Record which systems are supposedly affected.
5. Identify possible indicators.
6. Design an isolation plan.
7. Identify the logs that should be preserved.
8. Identify a suitable recovery point.
9. Document the recovery process.

42. Ransomware Prevention Checklist

• Maintain tested backups.
• Protect backup systems.
• Use MFA for important accounts.
• Apply security updates promptly.
• Use least privilege.
• Segment critical systems.
• Monitor authentication activity.
• Use endpoint security controls.
• Train users about phishing.
• Secure remote access.
• Monitor privileged activity.
• Maintain an incident-response plan.
• Test disaster-recovery procedures.

43. Review Questions

1. What is ransomware?
2. How can ransomware affect availability?
3. How can ransomware affect confidentiality?
4. What is encryption-based ransomware?
5. What is data extortion?
6. What is double extortion?
7. Name five possible ransomware entry points.
8. Why are backups important?
9. Why should backup restoration be tested?
10. What is backup immutability?
11. How can network segmentation reduce ransomware impact?
12. What is least privilege?
13. List five possible indicators of ransomware activity.
14. What is the purpose of containment?
15. Why is evidence preservation important?
16. What is the difference between RTO and RPO?
17. Why does paying a ransom not guarantee recovery?
18. Why should organizations have a ransomware response plan?

44. Key Takeaways

• Ransomware can disrupt access to systems and data.
• Modern ransomware incidents may involve data theft and extortion.
• Phishing, compromised credentials and vulnerabilities can provide entry points.
• Strong identity security reduces ransomware risk.
• Least privilege can limit the impact of compromised accounts.
• Network segmentation can help limit the spread of an incident.
• Reliable, protected and tested backups are essential.
• Backup availability alone does not guarantee successful recovery.
• Security monitoring can help identify suspicious activity.
• Early containment can reduce additional impact.
• Evidence should be preserved during incident response.
• Recovery should include security validation.
• RTO and RPO help organizations plan recovery requirements.
• Ransom payment does not guarantee recovery or protection of stolen data.
• Ransomware exercises should only be conducted in authorized environments.

45. Conclusion

Ransomware is both a cybersecurity and business-continuity challenge.
Effective protection requires multiple layers of defense rather than a single
security product.

Strong authentication, patch management, least privilege, segmentation,
endpoint protection, security awareness, monitoring and reliable backups all
contribute to resilience.

When ransomware is suspected, organizations should follow their incident
response procedures, contain affected systems, preserve evidence, investigate
the compromise and restore operations from trusted recovery points.

The next lesson will examine another major availability threat:
Denial-of-Service Concepts.