DataTerminology.comNEW
Malware that encrypts or blocks access to data and demands payment to restore availability, often coupled with data theft.
DESCRIPTION
Ransomware operators encrypt critical data and systems, demanding payment for decryption keys and sometimes threatening to leak stolen data (double extortion). Initial access commonly occurs via phishing, unpatched services, or compromised credentials. Effective defense combines backups with immutable or offline copies, least privilege, EDR, segmentation, and rapid incident response. Regular patching and continuous monitoring reduce attack surface. Recovery plans should be tested to minimize downtime without paying ransoms.
ALTERNATIVE DEFINITIONS
NIST IR 8374
Ransomware is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access.
Concise focus on encryption and extortion of organizational data.
CISA
Ransomware is an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable.
Emphasizes encryption rendering systems unusable and evolution of techniques.
RELATED TERMS
Malware Phishing Data Encryption Backup and Recovery Incident Response Double Extortion RĂ©nyi Differential Privacy Endpoint Detection and Response Network Segmentation
COMPETING TERMS
Offline Backups Zero Trust
KNOWLEDGE AREAS
Data Security Infrastructure Data Privacy & Compliance Data Management
TARGET AUDIENCE
Chief Information Security Officer IT Manager Cybersecurity Engineer Security Architect Data Privacy Officer Application Administrator
EXTERNAL SOURCES
- Wikipedia - Ransomware
- CISA - Government guidance and advisories
- NIST - Ransomware risk management profile
- ENISA - EU threat landscape analysis
TOP QUESTIONS
How does Ransomware typically infiltrate organizations?
Common vectors include phishing emails, exposed RDP services, software supply chain compromises, and exploitation of unpatched vulnerabilities.
Category: Threats
What is double extortion in Ransomware?
Attackers both encrypt data and exfiltrate it, threatening public release to pressure payment even if backups exist.
Category: Definition
Do backups guarantee recovery from Ransomware?
Only if backups are recent, tested, and isolated or immutable. Attackers often target backups first.
Category: Misunderstanding
Should organizations pay the ransom?
Authorities advise against payment; it doesn’t guarantee recovery and funds criminal activity. Focus on restoration and reporting.
Category: Opinion
What defenses reduce Ransomware risk?
Patch promptly, enforce MFA, segment networks, deploy EDR, restrict macros, and maintain tested offline backups.
Category: Best practices
How can we detect Ransomware early?
Monitor for unusual encryption activity, mass file access, privilege escalation, and anomalous outbound connections.
Category: Observability
What is the role of incident response in Ransomware?
A rehearsed plan covers containment, communication, forensics, recovery, and legal obligations to speed restoration and reduce impact.
Category: Management
How does Zero Trust help against Ransomware?
By minimizing implicit trust, limiting lateral movement, and enforcing least privilege, zero trust constrains blast radius.
Category: Alternatives
What regulations apply when data is stolen in Ransomware?
Breach notification laws and privacy regulations (e.g., GDPR) may require reporting and remediation for data exfiltration.
Category: Compliance