Ransomware Remediation and Prevention

Ransomware is a form of extortionware that encrypts files in order to prevent victims from accessing their systems and data. In many cases, encrypted files can only be recovered by purchasing a decryption key from the ransomware threat actor. If the victim doesn’t respond promptly enough to the ransom demand, the attacker may increase the ransom amount or delete the decryption key entirely, making the files virtually impossible to retrieve. Although law enforcement advises victims not to pay, many organizations will do so anyway based on business factors that include the degree to which operations are impaired, the potential impact on customers and shareholders, the relative costs of recovery and cleanup, and whether the threatened exposure of data could damage the organization’s brand or reputation.