# End-User Security Against Ransomware and Malware: How It Spreads, How to Stay Protected

**URL:** https://securesys.com.tr/en/learning/end-user-security/ransomware-and-end-user-security

![End-User Security Against Ransomware and Malware: How It Spreads, How to Stay Protected](/images/bilgi-merkezi/covers/cover-sonkullanici-11.webp)

Ransomware attacks have in recent years become one of the cyber threats organizations fear most. However, ransomware should not be evaluated only as simple malicious software that encrypts the files on a computer.

In modern attacks ransomware is most of the time the final stage of the attack chain.

The attacker first obtains access inside the organization.

Afterwards:

credential theft,

privilege escalation,

lateral movement,

security control bypass,

data discovery,

data exfiltration

they can carry out steps such as these.

At the very last stage, on the other hand, they can try to stop operations by encrypting the systems.

For this reason the ransom note appearing on the user's screen is not the beginning of the attack but most of the time the stage at which the attack has now become visible.

The attacker may have shown activity inside the environment for days or weeks.

**For this reason the modern Ransomware Protection approach cannot be reduced only to the question:**

**"Does antivirus block ransomware?"**

this question.

A strong ransomware defense architecture requires the following layers to work together:

**Security Awareness + Endpoint Hardening + EDR/XDR + Identity Security + Network Segmentation + DLP + SIEM/SOC + Secure Backup + Incident Response**

The fundamental principle is this:

**Trying to stop ransomware only at the moment of encryption can be too late; the aim is to break the attack chain at the earliest possible stage.**

### What Is Ransomware?

Ransomware is the malicious software and attack model that demands a ransom from the victim by blocking access to systems or data.

In classic ransomware scenarios files become encrypted and the attacker asks for payment in return for the decrypt key.

However, today many ransomware operations are not limited only to encryption.

The attacker can beforehand take sensitive data outside and use this threat:

**"If you do not pay we will publish your data."**

**This approach is called Double Extortion.**

### What Is Malware?

Malware is the abbreviation of the expression malicious software and is the general name of the harmful software developed for the purpose of damaging the system, stealing data, carrying out surveillance or providing unauthorized access.

Among malware types:

Ransomware,

Trojan,

Spyware,

Infostealer,

Worm,

Loader,

Backdoor

different categories such as these can be found.

For this reason not every malware is ransomware.

However, ransomware is also a malware type.

### What Is a Trojan?

A Trojan is the malicious program class that tries to get the user to run it by looking like legitimate or useful software.

While the user thinks they are running a cracked application, a fake update or an e-mail attachment Trojan execution can take place.

The Trojan can afterwards carry out activities such as:

credential theft,

remote access,

additional malware download

these.

### What Is an Infostealer?

An Infostealer is the malware type that focuses on stealing the valuable information located on the endpoint.

Among the targets:

browser passwords,

cookies,

session tokens,

credentials,

wallet information,

system information

can be found.

The reason why infostealer attacks are important is not only that they steal passwords.

Authenticated browser sessions can also be targeted.

For this reason even if the user is using MFA a stolen session token can create risk for some scenarios.

### What Is Spyware?

Spyware is the malicious software class used for the purpose of monitoring the user's activity or collecting information.

Spyware:

keystrokes,

browser activity,

credentials,

documents

can target information such as this.

### What Is a Loader?

A Loader is the malware type that first settles on the system and afterwards downloads or runs other malicious payloads.

For example the initial phishing attachment may not be ransomware directly.

At the first stage a loader can run.

The loader can afterwards download different malware components to the system.

This situation shows why ransomware attacks are multi-stage.

### What Is a Backdoor?

A Backdoor is the unauthorized access mechanism that provides for the attacker to be able to access the compromised system again later.

Thanks to a backdoor the attacker can provide persistence even if the initial vulnerability is closed.

For this reason during incident response deleting only the visible malware file is not sufficient.

### How Is Ransomware Transmitted?

There is no single transmission method for ransomware.

Initial Access can be obtained through different channels.

Among the most common risks:

phishing,

malicious attachments,

credential theft,

vulnerable internet-facing systems,

remote access compromise,

malicious downloads,

supply chain compromise

can be found.

In terms of end user security the most important starting points are phishing, web downloads and credential theft.

### What Is Initial Access?

Initial Access is the stage at which the attacker first enters the organization environment.

At this stage the attacker may not yet have run ransomware.

The aim is to obtain the first foothold.

For example:

a phishing account compromise,

malware execution,

a stolen VPN account

can provide initial access.

### How Does Phishing Turn into Ransomware?

A ransomware attack chain can proceed as follows:

Phishing E-mail

↓

Malicious Link or Attachment

↓

Credential Theft / Malware Execution

↓

Initial Access

↓

Privilege Escalation

↓

Lateral Movement

↓

Data Exfiltration

↓

Ransomware Deployment

For this reason phishing prevention is at the same time the first layer of ransomware prevention.

### What Is a Malicious Attachment?

A Malicious Attachment is a file added inside an e-mail that aims to create harmful activity as the result of user interaction.

This file:

a document,

an archive,

a script,

an executable

can be in different formats such as these.

Modern e-mail security can use sandboxing and content analysis.

However, endpoint security must also come into play as a second defense layer.

### Can a Malicious Link Cause Ransomware?

Yes.

The user can be redirected to a fake login page over a malicious link.

Credentials can be stolen.

The attacker can obtain VPN or cloud access over the stolen account.

In another case the user can run malware by downloading fake software.

Therefore the link does not have to carry the ransomware file directly.

### What Is a Drive-by Download?

A Drive-by Download is the attack model related to malicious content being delivered to the user device over a malicious or compromised website.

An outdated browser or a vulnerable application can increase the risk.

For this reason Safe Browsing, Secure Web Gateway and Patch Management are parts of ransomware defense.

### Fake Software Update and Ransomware

The user can click a fake update notification on a web site.

A file that looks like a fake browser update or utility software can actually be malware.

For this reason software must be installed only over approved sources and centralized deployment mechanisms.

### Why Is Credential Theft Critical for Ransomware?

When the attacker obtains a valid user account they may not have to bypass malware detection completely.

A normal login can be carried out with valid credentials.

Especially if:

VPN,

remote access,

a cloud account,

an administrator account

is compromised the ransomware attack chain can progress faster.

For this reason Identity Security is at the centre of ransomware defense.

### Can a Stolen VPN Account Turn into Ransomware?

Yes.

If the attacker obtains a remote access credential they can connect to the organization network like a legitimate user.

For this reason VPN access should be protected with:

MFA,

device compliance,

risk-based authentication,

monitoring

these.

### Does MFA Block Ransomware?

MFA is not a direct ransomware prevention technology.

However, it can significantly reduce the risk of unauthorized access over a stolen password.

Phishing-resistant MFA in particular reduces the ransomware attack surface for privileged and remote access accounts.

However, MFA does not block malware execution on the endpoint.

For this reason layered security is necessary.

### Why Is Phishing-Resistant MFA Important?

Traditional OTP or push MFA can be attempted to be bypassed in some phishing scenarios.

Phishing-resistant authentication methods such as FIDO2, WebAuthn, a passkey or a security key can help to reduce the credential theft risk.

This is valuable especially for administrator and remote access accounts.

### What Is Privilege Escalation?

Privilege Escalation is the attacker trying to raise the low-privilege access they have to higher privileges.

For example a standard user may have been compromised.

The attacker afterwards tries to obtain administrator privilege.

For ransomware to be deployed on a broad scale high privileges can be critical.

### How Does Least Privilege Slow Ransomware Down?

The user having only the permissions genuinely necessary limits the attacker's room for movement.

If a standard employee is not continuously working as a local admin what the malware can do can be reduced.

For this reason Least Privilege is one of the fundamental security principles of ransomware defense.

### Why Are Local Administrator Rights Risky?

If the user is a local administrator the malicious software they run can also obtain high privileges.

This situation increases the risks of:

security controls disable,

persistence,

system modification

these.

For this reason persistent local administrator privileges should be limited as far as possible.

### Why Is PAM Important in Ransomware Defense?

PAM, that is, Privileged Access Management, controls the use of high-privilege accounts.

Administrator credentials are extremely valuable for the attacker.

With PAM:

credential vaulting,

session control,

approval,

JIT access

controls such as these can be applied.

This can reduce the large-scale ransomware deployment risk.

### What Is Lateral Movement?

Lateral Movement is the attacker moving from the first compromised device to other systems.

The aim is to obtain access on:

additional accounts,

servers,

file shares,

critical systems

these.

For ransomware campaigns lateral movement is one of the critical stages.

### How Does Network Segmentation Protect Against Ransomware?

Network Segmentation prevents the attacker easily reaching the whole organization from one endpoint by separating the network into security zones.

When the user network is compromised there should not be unrestricted access to the critical server network.

Segmentation reduces the attacker's blast radius.

### What Is Blast Radius?

Blast Radius expresses how wide an effect a compromise event can create inside the environment.

In flat network structures a single compromised endpoint can access a large number of systems.

Segmentation and Least Privilege shrink the blast radius.

### Why Is a Flat Network Risky for Ransomware?

A Flat Network is the structure in which there are limited security boundaries between network segments.

When the attacker compromises one endpoint they can reach a large number of systems directly.

This situation can increase the ransomware spread risk.

### What Is Microsegmentation?

Microsegmentation provides more granular network isolation at the workload or application level.

A more detailed policy than traditional VLAN segmentation can be applied.

It is valuable in reducing the lateral movement risk especially for critical server environments.

### The File Share Ransomware Risk

If the user endpoint has write access to network file shares malware can also affect the files on these shares.

For this reason shared folder permissions should be managed carefully.

Every user having write permission on all shared repositories is risky.

### How Is Data Discovery Used in a Ransomware Attack?

The attacker can try to find valuable data inside the environment.

File servers,

databases,

cloud storage,

backup systems

can be targets.

Modern ransomware operators can try to understand which data is business-critical before encryption.

### Data Exfiltration and Ransomware

Instead of only carrying out encryption modern ransomware campaigns can first take the data outside.

In this way even if the organization restores from backup the attacker can threaten with data disclosure.

This method is the foundation of the double extortion model.

### What Is Double Extortion?

Double Extortion is the attacker using two different pressure methods:

- Encrypting the data.
- Threatening to publish the data.

In this case a backup restore operation can solve it but does not solve the confidentiality risk.

For this reason DLP and data security are part of ransomware defense.

### What Is Triple Extortion?

In some attacks the attacker can also use other pressure mechanisms in addition to the encryption and data leak threat.

For example they can try to reach customers or business partners.

These approaches are sometimes called Triple Extortion.

For this reason ransomware is now not only a technical but a reputation and business continuity incident.

### Living off the Land and Ransomware

Instead of using new malware tools the attacker can abuse the legitimate tools present on the operating system.

This method is known as Living off the Land.

Traditional antivirus can have difficulty distinguishing this activity with file reputation alone.

For this reason EDR behavioral analysis is important.

### How Does EDR Detect Ransomware?

EDR continuously collects telemetry on the endpoint.

Suspicious:

process execution,

mass file modification,

credential access,

unusual network activity,

security control tampering

behaviours such as these can be detected.

In this way the attack can be noticed not only when the final ransomware binary is seen but at earlier stages.

### Does EDR Definitely Block Ransomware?

No.

No security product provides one hundred percent protection.

EDR effectiveness depends on factors such as:

configuration,

coverage,

telemetry,

detection quality,

SOC response speed

these.

For this reason EDR is not a ransomware solution on its own.

### EPP and NGAV Ransomware Defense

The Endpoint Protection Platform and Next-Generation Antivirus try to stop known and suspicious malware at the prevention stage.

EDR, on the other hand, provides broader visibility and response.

Modern endpoint defense:

#### EPP/NGAV + EDR

should be thought of as this combination.

### What Is Behavioral Analysis?

Behavioral Analysis looks not only at the file's signature but at the activity it carries out.

For example a process that changes a large number of files in a short time can be suspicious.

However, a backup or legitimate encryption tool can show similar behavior.

For this reason context and detection tuning are necessary.

### Mass File Modification Detection

During ransomware encryption a large number of files are changed in a short time.

EDR or file monitoring systems can detect this activity.

However, when detection takes place some files may already have been affected.

That is why detecting earlier attack stages is preferred.

### How Does Application Control Work Against Ransomware?

Application Control can reduce the unknown executable risk by permitting only approved software to run.

Allowlisting can be a strong control for high-security environments.

However, it is not sufficient on its own for attacks in which legitimate tools are abused.

### What Is Attack Surface Reduction?

Attack Surface Reduction aims to limit the risky behaviors and execution paths the attacker can use.

For example:

unnecessary scripts,

macro behavior,

child process execution,

unauthorized applications

can be limited with policy.

The aim is to make the endpoint harder to attack.

### Macro Security

Office macros can be used for business automation.

However, they can be abused by malicious documents.

For this reason macro policies can be applied for untrusted documents coming from the internet.

Security decisions should be managed centrally according to the business requirement.

### Script Security

PowerShell and other scripting tools are necessary for system administration.

However, they can be abused by the attacker.

Completely disabling scripting may not be suitable for every environment.

For this reason:

logging,

constrained use,

EDR monitoring

can be more sustainable.

### Why Is Patch Management Important Against Ransomware?

The attacker can obtain initial access over a known vulnerability.

Patch Management reduces vulnerable systems.

Fast remediation is important especially for internet-facing services and critical vulnerabilities.

### Vulnerability Management

Patch Management is a part of the broader Vulnerability Management process.

During risk prioritization:

asset criticality,

internet exposure,

exploitability,

active exploitation

should be evaluated.

Vulnerabilities actively used by ransomware actors can be prioritized.

### Why Are End-of-Life Systems Risky?

Operating systems or applications that do not receive security updates can remain defenseless in the face of new vulnerabilities.

Legacy systems can be an easy target for ransomware campaigns.

If replacement is not possible segmentation and compensating controls are necessary.

### Ransomware and Backup

Backup is one of the most important controls of ransomware recovery.

However, only having a backup is not sufficient.

The backup must be:

accessible,

recent,

clean,

restorable

these.

The most critical point, on the other hand, is that the attacker cannot destroy the backup.

### What Is Immutable Backup?

Immutable Backup is the backup approach that aims to prevent backup data being changed or deleted for a particular retention period.

Even if the attacker obtains administrator access it is made harder for them to change the backup copy.

This is extremely valuable for ransomware resilience.

### What Is Air-Gapped Backup?

Air-Gapped Backup is a backup copy separated physically or logically from the production environment.

When the attacker compromises the production network they may not be able to access the backup directly.

This is an important defense layer for ransomware recovery.

### What Is Offline Backup?

Offline Backup is a backup that is not continuously accessible by normal production systems.

For example particular removable media or disconnected storage can be an example of this.

Offline backup can be protected from the attacker's automated deletion or encryption activity.

### What Is the 3-2-1 Backup Rule?

The common backup approach is expressed as:

3 copies of data,

2 different media types,

1 offsite copy

in this way.

In modern ransomware defense additional resilience controls such as an immutable or offline copy can also be evaluated.

### Is Backup Encryption Necessary?

Yes.

Inside a backup there can be a full copy of the production data.

For this reason in terms of confidentiality the backup should also be kept encrypted.

Backup protection should be not only a ransomware recovery but also a data security subject.

### Backup Network Segmentation

The backup infrastructure should be separated from the production user network.

Normal employee accounts should not access backup management interfaces.

This makes it harder for the attacker to reach backups over a compromised user account.

### Backup Administrator Account

Dedicated privileged accounts can be used for backup administration.

These accounts should not be used for normal e-mail or browsing purposes.

Protecting them with MFA and PAM is valuable.

### Why Is a Restore Test Important?

A backup having been taken does not guarantee that a restore can be carried out.

Testing a restore for the first time during a ransomware incident creates a serious risk.

For this reason regular recovery tests should be carried out.

### What Are RTO and RPO?

RTO:

#### Recovery Time Objective

expresses in how much time the service needs to come back.

RPO:

#### Recovery Point Objective

shows how much data loss is acceptable.

The ransomware recovery plan should be prepared according to these business requirements.

### Business Continuity and Ransomware

Ransomware is not only a cybersecurity incident.

At the same time it is a business continuity crisis.

E-mail,

ERP,

file services,

production systems

may not work.

For this reason ransomware planning should cover management and business units besides IT and security.

### Is Disaster Recovery Sufficient for Ransomware?

Traditional Disaster Recovery most of the time focuses on hardware failure or data center outage scenarios.

In ransomware, on the other hand, the source environment and backups can also be compromised.

**For this reason a Cyber Recovery approach should be planned separately.**

### What Is Cyber Recovery?

Cyber Recovery is the recovery approach that aims to restore business services safely using trusted systems and clean data after a destructive cyberattack.

The aim is not only a fast restore but to carry out:

**a clean restore**

this.

### What Is Clean Restore?

Clean Restore is services being set up again over an environment and backups verified not to contain attacker persistence or malware.

Restoring a compromised system as it is can also bring the attacker back.

For this reason forensic and incident response findings should be included in the recovery plan.

### How Is Ransomware Incident Response Carried Out?

Ransomware incident response typically includes the stages:

Detect

↓

Contain

↓

Scope

↓

Investigate

↓

Eradicate

↓

Recover

↓

Monitor

these stages.

The first target is not to shut down all systems randomly in a panic but to understand the attack scope and limit the spread.

### What Should the User Do When a Ransomware Sign Is Seen?

The user's first responsibility is to report the event quickly.

They should not try to clean the malware, restore the files or communicate with the attacker on their own.

They should activate the organization's incident response procedure.

### Why Is Endpoint Isolation Important in Ransomware?

If the compromised endpoint is isolated from the network the malware carrying out lateral movement or additional C2 communication can be limited.

EDR remote isolation capability can provide fast containment.

### What Is Network Containment?

During incident response the network access of compromised segments or systems can be limited.

The aim is to prevent the attack spreading to other zones.

Network containment can be carried out over firewall, NAC, EDR or segmentation controls.

### Can NAC Be Used in Ransomware Response?

Network Access Control can move the compromised endpoint to a quarantine VLAN or limit its network access.

This provides an additional control especially for endpoint isolation.

### When Should a Credential Reset Be Carried Out?

If the attacker has carried out credential theft the accounts can be at risk.

However, the timing of an organization-wide password reset should be planned carefully.

Understanding which credentials the attacker obtained and carrying out the reset over secure systems is important.

### Why Can Session Revocation Be Necessary?

Changing the password may not always end active authentication sessions automatically.

In cloud and identity environments compromised sessions should be revoked.

It is important especially in the case of an infostealer or token theft possibility.

### Why Is Service Account Security Critical for Ransomware?

Service accounts can sometimes have the features:

a long-lived password,

high privilege,

multiple system access

these.

If the attacker obtains these accounts lateral movement can become easier.

For this reason service accounts should be protected with least privilege and managed credentials.

### Domain Administrator Accounts

Accounts with domain-wide high privilege can be very valuable for ransomware actors.

These accounts should not be used for daily user activities.

Controls such as dedicated privileged workstations and strong MFA should be evaluated.

### What Is a Privileged Access Workstation?

A PAW is the hardened workstation approach set aside for privileged administration.

The administrator does not carry out activities such as e-mail or general web browsing on the same privileged environment.

This reduces the phishing-to-admin compromise risk.

### Ransomware and Active Directory

When the identity infrastructure is compromised the attacker can carry out broad-scale deployment and privilege escalation.

For this reason Active Directory or similar identity systems are a critical component of ransomware defense.

Identity Tiering and privileged account isolation can reduce this risk.

### Ransomware and Cloud Environments

Ransomware does not target only on-premises servers.

On cloud storage:

mass deletion,

file encryption,

account compromise

destructive actions such as these can be carried out.

For this reason cloud audit logs, versioning, backup and identity security are important.

### What Is SaaS Ransomware?

SaaS data may not be affected in the same way as by traditional executable ransomware.

However, using a compromised account files can be deleted, encrypted versions can be uploaded or large-scale destructive actions can be carried out.

For this reason SaaS backup and access security should be evaluated.

### Does File Versioning Protect Against Ransomware?

Versioning can provide for a return to the previous versions of some encrypted or modified files.

However, if the attacker can delete previous versions the protection decreases.

For this reason versioning does not take the place of backup.

### The Cloud Sync Risk

When a file is encrypted on the endpoint the cloud sync service can also synchronize the encrypted version to the cloud.

Versioning can help but the recovery plan should be tested in advance.

### Does DLP Block Ransomware?

DLP does not directly stop ransomware encryption.

However, it can help to detect or block the data exfiltration activity before a ransomware campaign.

For this reason it is important in reducing the double extortion risk.

### XDR Ransomware Detection

XDR combines signals coming from different security layers.

For example:

Phishing E-mail

Suspicious Login

Endpoint Alert

Network Anomaly

can be correlated under the same incident.

This makes it easier for the ransomware attack chain to be detected early.

### How Is NDR Used in Ransomware?

Network Detection and Response can detect unusual internal traffic, lateral movement or C2 patterns.

For unmanaged or legacy systems that have no EDR visibility NDR can provide additional visibility.

### Why Is SIEM Important in Ransomware Defense?

The SIEM:

Identity,

Endpoint,

Firewall,

VPN,

DNS,

Backup,

Cloud

can correlate these logs centrally.

This provides for the different stages of the attack to be seen under a single context.

### How Does the SOC Detect Ransomware?

The SOC should not wait only for a ransomware alert.

Early indicators should be monitored:

an unusual login,

unexpected admin privilege,

a suspicious process,

credential access,

a large data transfer,

a security agent disable attempt,

unusual internal scanning.

The aim should be to see the attack chain before encryption starts.

### Why Is Threat Hunting Important for Ransomware?

Threat Hunting provides for known attacker techniques and suspicious behaviors to be searched for proactively.

Activity in which a ransomware campaign has started but has not produced an alert can be found.

Historical EDR and SIEM telemetry is therefore valuable.

### The Difference Between IOC and IOA

An IOC, Indicator of Compromise, provides information about a known malicious artifact or infrastructure.

For example:

a hash,

a domain,

an IP.

An IOA, on the other hand, as an Indicator of Attack focuses on attacker behavior.

For modern ransomware defense not only IOCs but behavioral indicators are also important.

### MITRE ATT&CK and Ransomware

MITRE ATT&CK provides a common language for attacker tactics and techniques.

Ransomware detection programmes:

Initial Access,

Execution,

Persistence,

Privilege Escalation,

Credential Access,

Lateral Movement,

Exfiltration,

Impact

can evaluate coverage over stages such as these.

### Ransomware Kill Chain

The simplified ransomware attack chain:

#### Initial Access

↓

#### Execution

↓

#### Persistence

↓

#### Credential Access

↓

#### Privilege Escalation

↓

#### Discovery

↓

#### Lateral Movement

↓

#### Data Exfiltration

↓

#### Backup Disruption

↓

#### Encryption / Impact

The earlier detection is carried out in this chain the more the impact can be reduced.

### What Is Security Control Tampering?

Before encryption the attacker can try to disable EDR, antivirus or backup services.

This activity can be a strong security signal.

Tamper Protection is therefore important.

### What Is EDR Tamper Protection?

Tamper Protection makes it harder for unauthorized users or malware to disable or modify the endpoint security agent.

Even if there is administrator access additional protection mechanisms can be used.

This is important for ransomware resilience.

### What Is Log Tampering?

The attacker can try to delete or modify logs in order to reduce the traces of their activity.

Centralized SIEM logging reduces this risk.

Logs should not be kept only on the local endpoint.

### Can Honeypots and Deception Be Used for Ransomware?

Deception technology can detect the attacker touching fake resources that a normal user should not access.

For example a honey credential or decoy share access can create a high-confidence alert.

However, this is evaluated at more advanced maturity levels.

### What Is a Canary File?

A canary file is a monitored file that should not be changed in normal user activity.

If the canary file changes during mass encryption activity an alert can be produced.

This is a supplementary detection control.

### How Does Security Awareness Reduce Ransomware?

Many ransomware chains can start with user interaction.

If the user:

reports the phishing,

does not open the unexpected attachment,

does not download fake software,

refuses the unexpected MFA

initial access can be prevented.

However, awareness should not take the place of technical controls.

### How Should Ransomware Training Be Given to the User?

Giving the user the definition of "what is ransomware?" is not sufficient on its own.

Practical behaviors should be taught:

Do not open an unexpected attachment.

Do not download software outside an approved source.

Do not approve an unexpected MFA request.

Do not disable the security agent.

Report suspicious behavior immediately.

If you notice the device behaving abnormally inform the IT/security team.

This creates more effective awareness.

### What Are the Signs of Ransomware?

The user can notice some signs:

files are not opening,

file extensions are changing,

an unexpected ransom note,

the device is slowing down seriously,

the security software is giving a disabled warning.

However, in modern attacks the compromise can continue for a long time without the user seeing any sign.

For this reason monitoring is essential.

### **"Should I Shut the Computer Down Immediately?"**

The organization's incident response policy should be the determining factor.

In some cases network isolation can be more suitable.

A sudden shutdown can cause the loss of volatile evidence.

For this reason the user should quickly inform the security team instead of a technical intervention on their own.

### Should the Ransom Be Paid?

This decision is not one the technical team will give on its own.

Legal, regulatory, business, cyber insurance and law enforcement considerations should be evaluated.

Payment being made does not provide a guarantee of data recovery or deletion.

For this reason the essential target is for the organization to reach a level of resilience at which it will not have to make a payment.

### Ransomware Recovery

Recovery is not only restoring files.

First the attacker access path should be closed.

Otherwise after the systems are restored the attacker can carry out an attack again.

For this reason:

Root Cause Analysis

↓

Credential Security

↓

Clean Rebuild

↓

Restore

↓

Monitoring

this approach should be applied.

### What Is Root Cause Analysis?

Root Cause Analysis tries to determine how the attack started and which control gaps could be used.

For example the root cause can be:

phishing,

an unpatched vulnerability,

a stolen credential,

weak remote access

these.

If the root cause is not solved the incident can be repeated.

### What Is Lessons Learned?

After the incident technical and organizational findings are reviewed.

The questions:

Why was detection late?

Why was the backup affected?

Which controls worked?

Which controls did not work?

Was the SOC response sufficient?

This process increases security maturity.

### What Is a Ransomware Tabletop Exercise?

A Tabletop Exercise is a ransomware scenario being simulated at the table with the teams without carrying out an attack on real systems.

It tests the roles of IT, security, legal, management, communications and business units.

For example:

ERP down.

Backup integrity unknown.

Customer data exfiltrated.

The attacker sent a ransom request.

In this case who will do what?

These questions should be answered in advance.

### What Is Ransomware Simulation?

With authorized security testing detection and response capabilities can be verified in a controlled way.

The aim is not to encrypt real files but to test whether the behaviors in the ransomware attack chain are seen by the security controls.

Purple Team work is valuable in this respect.

### Ransomware KPIs

Ransomware readiness should be measurable.

Among the important metrics:

EDR Coverage

Patch Compliance

MFA Coverage

Privileged Account MFA Coverage

Backup Success Rate

Immutable Backup Coverage

Restore Test Success Rate

Mean Time to Detect

Mean Time to Contain

Local Admin Rate

Network Segmentation Coverage

can be found.

### What Is Mean Time to Contain?

MTTC shows in how much time the spread is limited after the threat is detected.

In ransomware even a difference of a few minutes can be very important.

Automated isolation and SOC playbooks can reduce this time.

### What Is a Ransomware Readiness Assessment?

A Ransomware Readiness Assessment is the evaluation of the organization's ransomware prevention, detection, response and recovery capabilities.

The assessment can cover these areas:

Identity

Endpoint

Network

Backup

SOC

Incident Response

Business Continuity

The aim is not only to create a security product inventory but to determine the real resilience level.

### The Most Frequently Made Mistakes in Ransomware Defense

The mistakes frequently seen in organizations are these:

- Seeing ransomware only as an antivirus problem
- Not tracking EDR coverage gaps
- Not monitoring EDR alerts 24/7
- Not using MFA
- Not applying strong MFA for privileged accounts
- Giving users continuous local admin
- Using a flat network
- Not applying network segmentation
- Leaving the backup infrastructure in the same security model as the production domain
- Not using immutable backup
- Not carrying out restore tests
- Not protecting backup administrator accounts sufficiently
- Leaving unpatched internet-facing systems
- Not segmenting End-of-Life systems
- Leaving service accounts uncontrolled
- Ignoring the data exfiltration risk
- Not using DLP
- Not carrying out threat hunting
- Not creating a ransomware incident response plan
- Not carrying out a tabletop exercise
- Not measuring detection-to-containment times
- Seeing security awareness only as an annual presentation

### Ransomware Security Checklist

Organizations can regularly evaluate the following controls:

- Are all endpoints under EDR protection?
- Is EDR agent health monitored centrally?
- Is EDR Tamper Protection active?
- Are critical alerts monitored 24/7?
- Is MFA mandatory for remote access?
- Do privileged accounts use phishing-resistant MFA?
- Have local admin rights been limited?
- Is PAM being applied?
- Are service accounts in the inventory?
- Are service account privileges reviewed?
- Are internet-facing assets in the inventory?
- Are critical vulnerabilities patched on time?
- Have End-of-Life systems been detected?
- Is network segmentation being applied?
- Have critical servers been separated from user networks?
- Are lateral movement detections present?
- Does DLP carry out data exfiltration monitoring?
- Is the backup infrastructure isolated as a network?
- Is immutable backup present?
- Has offline or air-gapped backup been evaluated?
- Are backup administrator accounts separate?
- Are backups encrypted?
- Are restore tests carried out regularly?
- Have RTO/RPO been defined with business requirements?
- Is there a SaaS and cloud data backup/recovery plan?
- Does the SIEM collect Identity, Endpoint, Network and Backup logs?
- Does the SOC use a ransomware playbook?
- Is threat hunting being carried out?
- Has a ransomware tabletop exercise been carried out?
- Is an incident communication plan present?
- Is a clean recovery process defined?
- Are ransomware readiness KPIs being measured?

### Ransomware Security Maturity Model

#### Level 1 – Antivirus and Backup

The organization uses antivirus and standard backup.

Detection and incident response capabilities are limited.

#### Level 2 – EDR, MFA and Patch Management

Endpoints are protected with EDR.

Remote access is secured with MFA.

Patch Management and basic segmentation are applied.

#### Level 3 – SOC and Secure Backup

EDR alerts are monitored 24/7.

SIEM correlation is applied.

Immutable/offline backup and regular restore testing are used.

#### Level 4 – Integrated Ransomware Defense

Identity, Endpoint, Network, DLP, XDR and Backup signals are correlated.

Threat Hunting and Purple Team validation are carried out.

Privileged access is protected with PAM and JIT.

#### Level 5 – Cyber Resilience

The organization focuses not only on attack prevention but on business continuity and clean recovery capability.

Adaptive security controls, automated containment, cyber recovery environments and regularly tested incident exercises are applied.

The target:

**is for the organization to be able to continue its business continuity in a controlled way even if a ransomware attack takes place.**

### Frequently Asked Questions

#### What is ransomware?

Ransomware is the malware and attack model that demands payment from the victim by blocking access to systems and files or by encrypting the data.

#### How is ransomware transmitted?

Different initial access methods such as phishing, malicious attachments, stolen credentials, vulnerable systems, malicious downloads and compromised remote access can be used.

#### What is malware?

Malware is the general name of the malicious software used for the purpose of damaging systems, stealing information or providing unauthorized access.

#### What is a Trojan?

It is the malware type that targets the user running it by looking like legitimate software.

#### What is an Infostealer?

It is the malware type that focuses on stealing browser credentials, cookies, session tokens and other sensitive information.

#### Does ransomware only encrypt files?

No. Modern campaigns can include many activities such as data exfiltration, credential theft, lateral movement and backup destruction.

#### What is Double Extortion?

It is the attacker both encrypting the data and threatening to publish the stolen data.

#### Does EDR block ransomware?

EDR can detect and respond to suspicious endpoint behaviors. However, no EDR gives a guarantee of one hundred percent protection. Defense in Depth is necessary.

#### Is antivirus sufficient for ransomware?

No. Alongside Endpoint Security, MFA, Least Privilege, Network Segmentation, Backup Security, SIEM/SOC and Incident Response are necessary.

#### Why is Network Segmentation important against ransomware?

It reduces the blast radius of the attack by limiting lateral movement from the compromised endpoint to other systems.

#### What is Immutable Backup?

It is the backup copy approach that cannot be changed or deleted for a particular retention period.

#### Is Offline Backup effective against ransomware?

Because it cannot be accessed from the production network it can make it harder for the attacker to encrypt or delete the backup.

#### If there is a backup is the ransomware problem solved?

No. Backup provides recovery but does not solve the data exfiltration, identity compromise and initial access problems.

#### Why should a Restore Test be carried out?

Regular restore testing is necessary in order to verify that the backup really can be recovered.

#### When does a ransomware attack start?

It can start not when the user sees the ransom note but at the moment the attacker obtains initial access. Encryption can be one of the final stages of the attack chain.

#### Can a ransomware attacker stay in the system for weeks?

Yes. In some attacks the attacker can carry out discovery, credential theft, lateral movement and data exfiltration before encryption.

#### Is DLP useful against ransomware?

It does not directly block encryption but can help in detecting data exfiltration and double extortion risks.

#### How is XDR used against ransomware?

It aims to notice the attack chain earlier by correlating Endpoint, Identity, Email, Network and Cloud signals.

#### Why is the SOC important in ransomware defense?

It provides for security alerts to be monitored continuously, for investigation to be carried out and for containment actions to be applied quickly.

#### What is Cyber Recovery?

It is the approach of bringing critical services back safely using clean systems and trusted backups after a destructive cyberattack.

### Conclusion: Ransomware Does Not Start with the Ransom Note

Looking at ransomware only through the encryption at the final stage is one of the most important security mistakes.

When the user sees the ransom note on the screen the attacker may have:

collected credentials,

obtained administrator access,

moved inside the network,

discovered critical systems,

taken the data outside,

tried to reach the backups

done these.

That is, the visible ransomware event:

**can be not the beginning of the attack but its result.**

For this reason building ransomware defense only on blocking the encryption process on the endpoint is not sufficient.

The real approach:

#### Initial Access Prevention

↓

#### Identity Protection

↓

#### Endpoint Detection

↓

#### Privilege Control

↓

#### Network Segmentation

↓

#### Data Exfiltration Detection

↓

#### Secure Backup

↓

#### Incident Response

↓

#### Cyber Recovery

should be thought of in this way.

The user here is a critical defense layer.

They can report the phishing.

They may not open the unexpected attachment.

They may not download the fake update.

They can refuse the unexpected MFA request.

However, the organization should never trust the assumption:

**"If the user does not make a mistake there will be no ransomware."**

this assumption.

Because the attacker can also use a vulnerability.

They can buy credentials.

They can compromise third-party access.

They can abuse legitimate tools.

Therefore the fundamental formula of modern ransomware defense:

**Security Awareness + Identity Security + Endpoint Hardening + EDR/XDR + Least Privilege + Network Segmentation + Secure Backup + SOC + Incident Response**

can be thought of in this way.

Even more importantly the organization's target should not be only to block ransomware completely.

The real cyber resilience question is this:

**"Even if the attack takes place, how quickly do we detect it, in how small an area do we keep it and how quickly can we bring our business back?"**

And the most important sentence of this chapter is this:

**Do not look for ransomware when the ransom note appears; try to catch it at the phishing, identity theft, privilege escalation, lateral movement and data leakage stages.**