How ransomware works

Ransomware is the attack every business owner dreads. Your files are locked, your systems stop, and a criminal wants money to give them back. It sounds dramatic, but it usually starts with something small.

How it gets in

Most ransomware attacks begin in one of three ways.

• A click on a dodgy attachment or link, often in a phishing email
• A stolen password, especially on remote access or email without MFA
• A system that missed its updates, leaving a known hole open

The quiet part

Once inside, attackers often take their time. They look around your network, work out where your important files and backups are, and many now copy your data out before they do anything visible. That stolen data becomes extra leverage later.

Then it strikes

When the ransomware runs, your files are encrypted: scrambled with a key that only the criminals hold. A note appears demanding payment, usually in cryptocurrency. Increasingly it comes with a second threat: pay, or we publish your data. This is called double extortion.

Should you pay?

Paying doesn't guarantee you'll get everything back. Decryption tools can be slow or broken, data may still be leaked, and businesses that pay are often targeted again. Every payment also funds the next attack. The Australian Government advises against paying.

The real defence: stop it getting in

The good news is that the basics block most attacks.

• Keep systems patched. Install updates for operating systems and apps promptly.
• Turn on MFA everywhere you can, especially email and remote access.
• Train your team to spot phishing, the most common hook.
• Limit admin access so one compromised account can't reach everything.

Backups are your safety net

If ransomware does get through, good backups mean you can restore instead of paying. They need to be:

• Tested, so you know a restore actually works
• Stored where ransomware can't reach them: offline, off-site or immutable

Backups that sit on the same network, always connected, are often encrypted along with everything else.

If it does happen

Disconnect affected machines from the network, don't wipe anything yet, and call your IT provider. Report it to the Australian Cyber Security Centre at cyber.gov.au. If personal information is involved, you may also have notification obligations under the Notifiable Data Breaches scheme.

The bottom line

Ransomware is a business problem, not just an IT one. Patching, MFA, training and tested backups won't make you invincible, but they make you a much harder target and turn a potential disaster into a recoverable bad day.

Want to know where your business stands? Try our useful free tools at nexcentric.com.au/tools, or talk to Nexcentric about a ransomware-ready backup plan.