---
{
  "title": "Ransomware",
  "summary": "Extortion can involve service disruption, stolen data, or both.",
  "topic": "foundations",
  "level": "Beginner",
  "updated": "2026-10-12",
  "units": [
    3
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: An Introduction to Information Security",
      "url": "https://csrc.nist.gov/pubs/sp/800/12/r1/final"
    },
    {
      "title": "NIST IR 8374: Ransomware Risk Management Profile",
      "url": "https://csrc.nist.gov/pubs/ir/8374/final"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Ransomware incidents commonly involve malicious encryption, data theft, or threats intended to force payment. The event may begin long before encryption with identity compromise and lateral movement. Response needs to consider the spread of access, evidence preservation, communication, and safe recovery. Tested isolated backups help availability, while preventing unauthorized data access is a separate requirement. Business and legal decisions should be handled by the responsible teams.

## In practice

An attacker steals files before encrypting servers. Restoring the servers may recover operations but does not reverse the exposure of those files.

## A common misunderstanding

A backup is not a complete ransomware strategy. It does not prevent exfiltration or remove an attacker’s surviving access.

## Check your understanding

What needs checking before restoring operations?

**Think it through:** Whether the entry point and persistence are addressed, recovery copies are trustworthy, and restored systems can be monitored.


## Encryption is often a late visible stage

A ransomware incident can include initial access, account misuse, discovery, lateral movement, data collection, recovery interference, and eventual disruption. Some extortion incidents emphasize stolen data rather than encryption. Investigating only the moment files become unreadable can miss the access and exposure established earlier. Describe the behaviors actually supported by evidence.

Backups support recovery but do not undo disclosure or automatically remove compromised access. Protected copies, separate administration, usable recovery procedures, and restoration tests address different dependencies. A successful backup job is weaker evidence than a demonstrated return of a representative service to trustworthy operation.

## A fictional shared-storage incident

An academy discovers unreadable files on a shared service. Responders coordinate containment, preserve endpoint and identity records, assess affected systems, and check recovery integrity. The team also reviews earlier account and data-access activity rather than assume no theft occurred because the visible symptom is encryption.

Decisions about external communication, reporting, extortion demands, and business priorities require the responsible incident leadership and specialists. Technical analysts should provide evidence and limitations without promising that any payment or tool guarantees recovery. The recovery plan should address the original access path before restored systems return to normal connectivity.

## Rehearse a recovery decision

Use a fictional diagram with production storage, administrator accounts, protected backups, and an isolated recovery environment. Identify who authorizes containment, which recovery point is trustworthy, and how application owners validate the result. Add a gap such as an unavailable key or untested dependency and explain the next decision.

Preparedness combines prevention, detection, response, and resilience. An organization needs clear roles and communication as well as technical controls. The purpose of the exercise is to expose dependencies and improve a practical plan, not to run destructive encryption or simulate extortion against real staff.

## Keep exploring

- [[backups]]
- [[containment]]
- [[lateral-movement]]
- [[exfiltration]]