Ransomware headlines tend to focus on the dramatic moment: screens locked, a ransom note on display, operations grinding to a halt. Yet investigators who pick through incidents afterwards usually find a far less dramatic story. The attackers rarely begin with exotic technology. They begin with an unpatched system, a weak password, a convincing email, or a backup that turned out never to have worked. Defence, therefore, rarely begins with expensive tools either. It begins with boring basics, done consistently.
That is an encouraging message for organisations without large security teams. The measures that stop or blunt most attacks are well understood, comparatively cheap, and within reach of almost any business, school, charity or local service. The difficulty is not knowing what to do; it is doing it every week, for every device and every account, including the ones nobody quite remembers owning.
How Most Attacks Still Begin
Phishing remains a reliable doorway. A message imitates a supplier, a delivery firm or a senior colleague, and a single click hands over credentials or installs malicious software. In other cases, attackers scan the internet for exposed remote access services and outdated software with known flaws, then walk through openings that a routine update would have closed. Stolen passwords bought or leaked from elsewhere are tried against email and remote systems, succeeding wherever the same password has been reused and no extra verification step stands in the way.
Guidance from the National Cyber Security Centre returns repeatedly to these entry points because they account for so much real-world harm. None of them requires an attacker of genius. They require only an organisation that has postponed patching, left an old account active, or allowed staff to work without a safety net when — not if — someone is deceived by a well-crafted message on a busy morning.
Backups, Patching and People
Backups are the single most valuable preparation, provided they are genuinely separate from the main network and regularly tested. A backup that an attacker can also encrypt is not a backup; nor is a copy whose restoration has never been attempted. Keeping at least one copy offline or in a separate, protected service, and practising restoration on a quiet afternoon, turns a potential catastrophe into a serious but survivable disruption.
Patching deserves the same routine status. Updates for operating systems, browsers and internet-facing software should be applied promptly, with automatic updating switched on wherever possible. Add multi-factor authentication for email, remote access and administrator accounts, use unique passwords managed through a password manager, and remove accounts and software that are no longer needed. Finally, invest in people: short, regular reminders about suspicious messages, and a culture where reporting a click quickly is praised rather than punished, shorten the time attackers have to spread.
When Prevention Fails
Even well-run organisations can be breached, so a simple incident plan matters. Who decides whether to disconnect systems? Who contacts insurers, regulators, customers and law enforcement? Where are the contact details kept if the usual network is unavailable? Answering those questions in advance, on paper, saves precious hours. Isolating affected devices quickly can limit encryption spreading, and preserving evidence helps investigators understand what was accessed.
Paying a ransom is widely discouraged by authorities: it does not guarantee data will be returned or systems restored, it may fund further crime, and stolen information may still be published. Recovery from clean backups, though painful, is usually the firmer path. The lesson running through every serious post-incident report is the same. Ransomware succeeds against the unprepared far more often than against the well defended — and preparation, unglamorous as it sounds, is mostly a matter of habits.
Read more on techhopes.com and in our Tech pages.
