In short
Ransomware is malicious software that encrypts an organization's data or systems and demands payment for the key, often also threatening to publish stolen data.
Key takeaways
- The best recovery control is backups kept offline or immutable, with tested restores.
- The first response to an outbreak is containment: isolating affected systems.
- Prevention includes patching, email filtering, least privilege and multi-factor authentication.
Where it's tested
ISC: Incident Response & Monitoring — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
Security staff find ransomware spreading on several servers. What should they generally do first?