Ransomware: the two problems most vendors only half-solve

Almost every ransomware product on the market is sold against one problem. There are two, and they fail in opposite directions.

Problem one is availability. Your files are encrypted and the business cannot run. This is the problem everyone plans for, and it is genuinely solvable — good backups solve it.

Problem two is disclosure. Your data has already left the building, and the attacker will publish it whether or not you decrypt anything. Backups do not touch this problem. Nothing does, after the fact.

An organisation that has solved only the first problem will restore in a day, congratulate itself, and then watch its customer list appear on a leak site three weeks later. That is not a hypothetical failure mode. It is the standard one.

Why the second problem became the main one

Encryption-only ransomware was a straightforward extortion: pay, get the key, move on. Backups broke that business model, so the model changed. CISA’s #StopRansomware Guide describes the result — “double extortion”, where attackers both encrypt files and steal data, then threaten public release to coerce payment even where decryption has already happened. The guide also notes that some actors now skip the encryption entirely and use the threat of disclosure alone.

Think about what that means for your controls. If the adversary never encrypts anything, every detection built around mass file modification is silent. There is no ransom note on the screen. The first indication is an email naming files you recognise.

What each problem actually requires

Availability: backups that survive the attacker

The failure is almost never “we had no backups”. It is “the backups were reachable from the network the attacker owned”. Ransomware operators look for backups specifically and destroy them before triggering encryption, because a restorable victim does not pay.

CISA’s guidance is direct: maintain offline, encrypted backups of critical data and test their integrity regularly. Keep them disconnected, because anything mounted is a target. Hold golden images so systems can be rebuilt rather than cleaned. Immutable storage is worth considering, with the caveat that it brings its own misconfiguration risk.

The test that matters is not “do backups exist” but “restore a representative system from cold storage, end to end, and time it”. Most organisations have never done this and discover during an incident that the restore takes four days, that a dependency was never backed up, or that nobody holds the credentials needed to start.

Disclosure: the only defence is before

Once data is out, the options are legal and reputational, not technical. The controls that matter are all preventive and all boring.

• Know what you hold and where. You cannot protect data you have not inventoried, and you cannot assess an incident’s severity without knowing what was in the share the attacker reached.
• Delete what you do not need. The cheapest reduction in breach severity is holding less. Most organisations retain years of data with no business reason and no legal obligation.
• Segment. A flat network means one compromised workstation reaches everything. Segmentation is what turns a catastrophe into an incident.
• Watch egress, not just ingress. Large outbound transfers to unfamiliar destinations, at unusual hours, are the signal. Most monitoring is pointed at what comes in.
• Constrain administrative accounts. Exfiltration at scale needs broad read access. Standing domain-wide admin rights are what provide it.

The doors they come through

CISA identifies six primary initial access vectors: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, precursor malware infections, advanced social engineering, and compromise through third parties and managed service providers.

That last one deserves attention because it is the one organisations do not control directly. Your IT provider’s remote management tool is, from an attacker’s perspective, a pre-installed route into every one of their clients at once. If you outsource IT, your ransomware exposure includes their security posture, and almost nobody audits it.

Note also what is absent from that list: exotic zero-days. The common routes are an unpatched edge device, a credential that should have been rotated, and a person who clicked something. Sophistication is in the operation, not the entry.

The first hour

CISA’s response checklist runs in a fixed order: detection and analysis, then reporting and notification, then containment and eradication, then recovery and post-incident activity. Two points inside it are routinely got wrong under pressure.

Isolate, do not wipe. The instinct is to rebuild fast. Rebuilding destroys the evidence needed to answer the only question that matters afterwards — what did they take? Without that, you cannot scope the notification obligation, and you end up either over-notifying or making statements you cannot support.

Collect forensics before eradication. Memory, logs and disk images have a short shelf life. Logs roll. Cloud audit trails expire. An organisation that skips this in hour one is guessing about disclosure for the rest of the incident.

The honest assessment

Ask two questions of whatever you have in place. First: if everything encrypts tonight, how long until we are trading again, and who has actually timed that? Second: if nothing encrypts but forty gigabytes left the network last Tuesday, would we know, and could we say what was in it?

Most organisations have a defensible answer to the first and no answer at all to the second. That gap is where the real loss sits.

Honeybadger Solutions works both halves — preparation and the question of what actually left. Determining scope after an incident is a forensic exercise, covered under digital forensics, and where an intrusion needs to be traced rather than merely cleaned up, that falls under cyber investigations. The human vector that opens most of these doors is addressed through security awareness training.