One Monday morning, the screens display a message: “Your files have been encrypted.” Email is dead, business apps are down, and a countdown demands a ransom in cryptocurrency. Thousands of organisations live this scene every year. The good news: a ransomware attack is not inevitable. It follows a known — therefore predictable — scenario, and is prepared long before D-day.
In this article, we take apart how ransomware works step by step, list the mistakes that cost dearly, then detail a concrete remediation plan and a checklist to keep at hand. The goal: that you, as an IT director or manager, know exactly what to put in place — and what to do if the incident strikes.
1. What exactly is ransomware?
Ransomware is malicious software that encrypts your data to make it unusable, then demands a ransom in exchange for the decryption key. But in recent years, attackers no longer just block: they first steal the data, then threaten to publish it. This is double extortion — and sometimes triple, adding blackmail of customers or a denial-of-service attack.
Key takeaway
Modern ransomware isn’t “just” encryption: it’s a data theft + encryption + blackmail. Paying the ransom guarantees neither recovery nor the non-disclosure of what has already been exfiltrated.
2. Anatomy of an attack, step by step
Unlike the image of a “virus” striking at random, a ransomware attack is a driven process, often over several days. Understanding its phases means spotting as many opportunities to detect and stop it.
The most common entry points
- Phishing: a booby-trapped email that steals a password or installs an initial payload.
- Exposed remote access: an RDP or VPN reachable from the Internet, without two-factor authentication.
- Unpatched vulnerabilities: a server or device behind on updates.
- Supply chain: a compromised provider or third-party software.
3. The misconceptions that cost dearly
“We’re too small to be targeted”
Most attacks are opportunistic and automated: they target a flaw, not fame. SMEs and public bodies are prime targets.
“We have backups, that’s enough”
If backups are reachable from the network, attackers encrypt or wipe them first. Without an immutable, isolated copy, they won’t save you.
“Antivirus protects us”
A classic antivirus detects known signatures. Modern ransomware bypasses it: you need behavioural EDR and monitoring.
“We’ll pay and it’ll all come back”
Paying funds crime, offers no guarantee, and already-stolen data stays in their hands. It’s a gamble, not a solution.
4. Prepare: defence in depth
No single measure stops ransomware. The right approach stacks complementary layers: if one gives way, the next hold. This is the defence-in-depth principle.
The 3-2-1 rule (worth knowing)
3 copies of your data, on 2 different media, of which 1 offline / immutable and off-site. It’s the line of defence that lets you refuse to pay and restore on your own.
5. In the event of an attack: the remediation plan
If the incident occurs, improvising makes everything worse. A clear, known, rehearsed plan saves hours — sometimes days. Here’s the five-step outline.
Alongside the technical response, two reflexes: trigger the crisis unit (management, IT, communications, legal) and notify the relevant authorities — in France, the CNIL within 72 h for a personal-data breach, and file a complaint. Preserve the evidence (logs, affected systems): it’s essential for analysis and insurance.
Should you pay the ransom?
The authorities’ recommendation (including France’s ANSSI) is clear: do not pay. Paying sustains the criminal model, doesn’t guarantee restitution, and exfiltrated data stays compromised. The real answer is prepared beforehand: immutable backups and a tested recovery plan make the blackmail powerless.
6. Your anti-ransomware checklist
Before — prepare
- MFA on all access (VPN, email, admin)
- Immutable, isolated and tested backups (3-2-1 rule)
- EDR deployed + monitoring / SOC
- Patches up to date and exposure reduced (no open RDP)
- Network segmentation and privileged accounts under control
- Written incident-response plan, with contacts and roles
During — react
- Isolate affected machines (without shutting them down if possible)
- Trigger the crisis unit and preserve evidence
- Scope the perimeter before any restore
- Notify (CNIL 72 h, complaint, insurance)
After — learn
- Fix the root cause before reconnecting
- Rotate secrets and passwords
- Lessons learned and hardening
7. Frequently asked questions
How long does an attack last, from start to encryption?
Often several days. Attackers explore the network, steal the data, then trigger encryption at the most damaging moment (weekend, night). This delay is precisely the window where good detection can stop the attack.
Is cyber insurance enough?
It helps absorb the financial shock, but doesn’t restore your operations and increasingly requires a minimum security level (MFA, backups, EDR). Insurance complements prevention, it doesn’t replace it.
Are our cloud backups safe?
Not automatically. If they’re reachable with the same credentials as the IS, they can be encrypted or deleted. You need strong isolation (immutability, separate accounts, MFA) and regular restore tests.
Where to start if you’re at zero?
Three high-impact priorities: MFA everywhere, tested immutable backups, and a detection capability (EDR). A security audit then helps prioritise the rest based on your real risks.
Against ransomware, anticipation changes everything.
ZENISEC helps you assess your exposure, harden your IS and build a recovery plan that makes blackmail powerless.
Case study: Operation & security of a critical multi-site IS →
Comments are closed