How can you effectively protect against ransomware?

What exactly is ransomware and how does an attack unfold?

Ransomware is a type of malicious software specifically designed to encrypt files on a computer, server, or entire network. The attackers then demand a ransom payment, typically in cryptocurrencies such as Bitcoin, in exchange for the decryption key. However, there is no guarantee that paying the ransom will actually result in data recovery.

Modern ransomware variants such as LockBit, BlackCat (ALPHV), and Cl0p employ advanced encryption algorithms and frequently spread through multiple attack vectors:

• Phishing emails containing malicious attachments or links
• Security vulnerabilities in outdated software or operating systems
• Compromised Remote Desktop Protocol (RDP) connections
• Supply chain attacks through infected software updates
• Drive-by downloads from compromised websites

Particularly dangerous is the practice known as double extortion: attackers additionally steal sensitive data and threaten to publish it, even if a backup exists. This tactic significantly increases pressure on organizations.

Which businesses and individuals are most at risk?

In principle, any system can become the target of a ransomware attack. However, certain groups face disproportionately higher risk:

Attackers select targets strategically: they look for organizations under high operational pressure with simultaneously weak IT security. Companies that depend heavily on data availability are statistically more likely to pay.

What prevention strategy offers the best ransomware protection?

Effective ransomware protection does not rely on a single measure but on a multi-layered security concept. The most important components include:

Technical measures:

• Regular security updates for operating systems, applications, and firmware
• Endpoint Detection and Response (EDR) instead of basic antivirus software
• Network segmentation to limit lateral movement
• Multi-factor authentication (MFA) for all remote access points
• Disabling macros in Office documents from unknown sources
• Restricting administrator privileges following the principle of least privilege

Organizational measures:

• Regular employee training on recognizing phishing attempts
• Establishing an incident response plan
• Conducting penetration tests and security audits
• Clear policies for handling email attachments and external storage devices

The combination of technical and organizational measures is critical. Even the best firewall is ineffective if an employee opens a malicious email attachment.

Professional data recovery needed?

Request a data recovery quote now.

Request professional data recoveryProf. data recovery needed?0800/073 88 36

What should a backup strategy against ransomware look like?

Backups represent the most important line of defense against ransomware. However, modern attackers deliberately target connected backup media and network drives for encryption. An effective backup strategy must therefore meet specific requirements:

The 3-2-1 principle:

• 3 copies of data (original + 2 backups)
• 2 different storage media (e.g., NAS + external hard drive)
• 1 copy at an external or offline location

Additional recommendations:

• At least one backup must be physically separated from the network (air gap)
• Use immutable storage that prevents retroactive modifications
• Regularly verify backup integrity through restore tests
• Enable versioning to fall back to older, unencrypted file versions
• Manage backup credentials separately, not stored in Active Directory

A backup that was connected to the network at the time of attack may also be compromised. Regular creation of offline backups is therefore essential. For more information about data loss from storage media failures, see our article on preventing data loss on external drives.

What should you do immediately during an active ransomware attack?

When a ransomware infection is suspected, every minute counts. The following immediate response measures can significantly limit the damage:

1. Disconnect affected systems from the network immediately (unplug network cables, disable WiFi) -- but do not shut down
2. Do not respond to the ransom demand and do not pay the ransom
3. Notify IT security personnel and management
4. Preserve evidence: screenshots of the ransom note, log files, timestamps
5. File a report with law enforcement cybercrime units
6. Engage professional incident response specialists

Important: The system should not be shut down, as the encryption key may still reside in RAM and can be extracted through forensic analysis. Learn more about forensic methods in our article What is IT forensics?.

Should you pay the demanded ransom?

The clear recommendation from security agencies including the FBI, Europol, and the German Federal Office for Information Security (BSI) is: Do not pay the ransom. The reasons:

• There is no guarantee of receiving a functioning decryption key
• Payment finances criminal organizations and motivates further attacks
• Victims who pay are frequently targeted again, as they are seen as willing to pay
• Even after decryption, backdoors may remain in the system
• In certain cases, payment may have legal consequences (sanctions lists)

Studies show that only approximately 65 percent of organizations that pay the ransom recover their data completely. The remainder receive only partial data or nothing at all. The better approach is working with professional data recovery specialists and IT forensics experts who can often find alternative recovery paths. Our article explains how professional data recovery works in detail.

Can encrypted data be recovered without paying the ransom?

In many cases, realistic chances exist for data recovery without ransom payment. Success rates depend on several factors:

Possible recovery paths:

• Known decryption tools: Free decryptor tools exist for older ransomware variants, e.g., on the No More Ransom platform (nomoreransom.org)
• Volume Shadow Copies (VSS): Windows shadow copies are not deleted by every ransomware strain
• Forensic RAM analysis: The encryption key may still be present in system memory
• Backup fragments: Partial or older backups may be recoverable
• Professional data recovery: Specialized laboratories can sometimes extract data from damaged or partially encrypted storage media

Success rates depend heavily on the specific ransomware variant and the timing of detection. Early response significantly improves the chances. Details about IT forensic evidence preservation can be found at How is evidence preserved in IT forensics?.

What role does employee awareness play in ransomware protection?

The human factor remains the largest entry point for ransomware. According to current studies, over 80 percent of successful ransomware attacks begin with a phishing email or another form of social engineering.

Effective awareness measures:

• Regular phishing simulations with subsequent evaluation
• Hands-on training sessions (not just theoretical presentations)
• Clear reporting channels for suspicious emails or incidents
• Positive error culture: employees must be able to report suspicious actions without fear of sanctions
• Regular updates on current threat landscapes and attack patterns

Training for employees in key positions is particularly important: executives, accounting staff, and IT administrators are frequent targets of targeted attacks (spear phishing).

Which technical security measures are essential for businesses?

Beyond general prevention, specific technical security measures should be implemented by every organization:

Additionally, RDP security should receive highest priority: the Remote Desktop Protocol is one of the most exploited entry points for ransomware. RDP connections should only be accessible via VPN, protected by MFA, and restricted to essential use.

When is professional help indispensable in a ransomware incident?

At a minimum, you should engage professional specialists in the following situations:

• The ransomware has spread to multiple systems or servers
• No usable backups exist or backups are also encrypted
• Sensitive business or customer data is affected
• A forensic investigation is necessary to determine the attack vector and scope
• Legal reporting obligations apply (e.g., GDPR notification to the data protection authority)

Professional data recovery specialists and IT forensics experts have the necessary laboratory equipment and experience to recover data even in difficult cases and to handle the incident in a legally compliant manner. Learn how to identify a competent service provider in our guide How to identify a trustworthy data recovery service.

In cases of critical data loss caused by ransomware, forensic reconstruction of deleted or manipulated data may also be possible. Read more at Can tampered or deleted data be reconstructed?.