Ransomware Prevention and Response Guide

Ransomware encrypts your files and demands payment for the decryption key. Attacks have become increasingly sophisticated, often including data theft before encryption (double extortion).

Prevention Measures

• Backup, backup, backup: Maintain offline or immutable backups that ransomware can't reach
• Patch promptly: Most ransomware exploits known vulnerabilities
• Email security: Block malicious attachments and links
• Endpoint protection: Modern EDR solutions can detect and stop ransomware
• Network segmentation: Limit lateral movement if one system is compromised
• Least privilege access: Users should only have access they need
• Disable macros: Block macro execution in Office documents by default

If You're Hit by Ransomware

1. Isolate immediately: Disconnect affected systems from the network
2. Don't pay immediately: Payment doesn't guarantee recovery and funds criminal operations
3. Contact authorities: Report to FBI's IC3 and your local field office
4. Engage incident response: Professional help is critical for proper recovery
5. Preserve evidence: Don't wipe systems until forensic analysis is complete
6. Check for decryptors: NoMoreRansom.org may have free decryption tools
7. Restore from backup: Only after ensuring backups aren't compromised

Building Ransomware Resilience

Organizations that recover quickly have these in common:

• Tested, offline backups with verified restore procedures
• Documented incident response plans
• Cyber insurance with ransomware coverage
• Regular tabletop exercises
• Relationship with incident response providers before an incident