How to Prevent and Recover from Ransomware
Ransomware Prevention: Your Defense Playbook
1. Back Up Your Data — The 3-2-1 Rule
Your most powerful defense against ransomware is a backup that ransomware cannot reach. Follow the 3-2-1 backup rule:
- 3 copies of your data
- Stored on 2 different types of media (e.g., external hard drive + cloud)
- With 1 copy kept offsite or offline (disconnected from your network)
Important: Backups connected to your computer can also be encrypted by ransomware. Disconnect external drives after backing up, or use cloud backups with versioning enabled.
2. Keep Software Updated
Enable automatic updates for your operating system, browser, and all software. The WannaCry attack succeeded largely because organizations had not applied a security patch that had been available for months.
3. Use Reputable Antivirus/Antimalware Software
Modern security suites detect and block many ransomware strains before they can execute. Keep definitions updated. Windows Defender (built into Windows 10/11) is a solid baseline — enable it.
4. Enable Controlled Folder Access (Windows)
Windows 10/11 includes a feature that prevents unauthorized applications from modifying files in protected folders. Enable it in Windows Security → Virus & Threat Protection → Ransomware Protection.
5. Be Cautious with Email Attachments
Never open unexpected attachments — especially .zip, .exe, .docm (macro-enabled), or .js files. Even PDFs can carry malicious code.
6. Disable Macros in Office Documents
Microsoft Office macros are a common ransomware delivery mechanism. Disable them by default and only enable for documents from trusted sources that you specifically requested.
7. Use a Standard (Non-Admin) User Account
Don’t browse the internet or open email using an administrator account. If ransomware executes under a limited account, it has fewer privileges to cause damage.
8. Be Careful with RDP
If you don’t need Remote Desktop access, disable it. If you do need it, use a VPN and enable Network Level Authentication.
If You Are Hit by Ransomware
- Disconnect immediately — unplug from the network (ethernet and Wi-Fi) to prevent spread to other devices.
- Do not pay the ransom — contact law enforcement (report to your local cybercrime unit).
- Check for free decryptors — visit nomoreransom.org, a collaborative project by law enforcement and security companies offering free decryption tools for many ransomware variants.
- Restore from backup — if you have clean backups, this is your recovery path.
- Seek professional help — a cybersecurity professional can assist with forensics and recovery.
Free Resource
Visit nomoreransom.org — a free resource from Europol, FBI, and cybersecurity companies offering decryption tools and guidance for ransomware victims.
]]>