Ransomware is, most commonly, the encryption of files with the requirement of paying a sum of money in exchange for the decryption key.

Ransomware comes in several forms such as social engineering attacks, infected removable media like USB drives, or malicious/compromised websites. Ransomware tends to mutate faster than what many vendors can keep up with, meaning the threat landscape quite literally changes daily.

Traditional defenses like antivirus, while certainly crucial, are sometimes ineffective at preventing all the different possible strains. So what happens with ransomware? Once files or digital assets become encrypted, one of three things will follow:
– Paying the ransom and hoping the attacker holds up their end of the deal.
-Wiping the affected systems and restoring from clean backups. Failing that, you may have to start all over and lose the data that was encrypted.
-Attempting to have it decrypted outside the ransomer’s channel.
Sadly it’s a rare occurrence that this is possible.

While we can’t un-ransomware systems, we can assist with:
-Post-attack analysis, helping to determine what happened, what the attack vector was and even reverse-engineering any ransomware found.
-Evaluating residual risk once the ransomware has passed, which is likely to exist. An evaluation of the controls or lack thereof will help identify weak points within the infrastructure that contributed to such attacks.
-Reducing social engineering risks through attack vectors such as email and educating staff on how to avoid such threats to mitigate the likelihood of future attacks.
-Penetration testing to evaluate your risk of attack and determine what needs to be shored up to reduce your risk.

While no one can completely defend against a ransomware attack, we can help to greatly reduce the likelihood. Whether you’ve already become a victim or just want to do as much as possible to avoid it, we are here to help.