Unfortunately you are viewing this website on an outdated browser which does not support the necessary features for us to provide an adequate experience.
Please switch to a modern browser such as latest version of Google Chrome, Mozilla Firefox, Apple Safari or Microsoft Edge.
There are things you can do to recover from a ransomware attack, but it's best to take steps to prevent an attack in the first place.
Ransomware is a type of malicious software that denies you access to your files or computer system unless you pay a ransom. Attacks can cause huge disruptions to businesses.
The most common ways attackers get in are:
This diagram shows how ransomware attacks happen.
The diagram is split into three phases showing the entry points of an attack and following the pathway across until the point where a ransom can be demanded.
The first phase shows how the attacker looks for ways into the network. The most common ways the attackers get in are:
The second phase shows how the attacker will look to move from the initial computer they compromised, and gain administrative access to all the computers and devices in your business.
The third phase shows when the attacker has gained access to the different systems in your business and is now ready to carry out the most damaging part of the attack.
Attackers will often steal your business’ sensitive data and demand payment in order to not release or sell that information. They also delete backup copies of your data and finally, encrypt your data and systems to disrupt your operations.
The individual elements in each phase are contained in yellow bordered circles while the relationship of the elements to each other and across the three phases are shown by connecting blue lines.
No single tool or control can be relied on stop all attacks, but in combination these controls put you in a good position to protect against any attack you might face (not just ransomware).
To get your business back up and running quickly it’s important to have robust and tested backups. These should be kept offline or disconnected from your computers so that an attacker can’t delete them.
Make sure you have hard copies of all any documentation that is important to your business in case you’re unable to access your system.
Regularly install updates on software and devices to prevent attackers from exploiting vulnerabilities which they could use to get into your systems.
By keeping all your operating systems and software up-to-date you limit the number of weaknesses an attacker could exploit to gain access to your computers.
To protect against an attacker logging in to your system remotely, use long, strong, unique passwords and turn on two-factor authentication (2FA).
Set up logs and alerts to help you detect any unusual or unexpected activity on your systems.
Install antivirus and anti-ransomware software on your computer and update it regularly. If you have support contracts with antivirus providers, make sure these are up to date too.
The other common thing attackers might try is sending a document or spreadsheet that, if opened, will try to load malware onto your computer without you knowing. This risk can be mitigated by using modern endpoint protection software. Ask your IT provider about Endpoint Detection and Response (EDR) tools they support.
Locking down use of administrative accounts as well as using network controls like firewalls can help you stop an attacker from being able to move from one device to another.
Identify any systems that might be exposed to the internet and lock these down – you might need some help from an IT provider to do this.
Make sure you and your staff know how to spot the danger signs of phishing campaigns, as well as other online security risks.
The best way to prepare to deal with a ransomware incident is having an incident response plan, to detail what to do when things have gone wrong and your computers aren’t working. Keep a printed copy of this along with key contacts so you have it to refer to if you can't access your saved files.
How ransomware works (with controls)
This diagram shows how ransomware attacks happen and is split into three phases showing the entry points of an attack and following the pathway across until the point where a ransom can be demanded.
A defence-in-depth application of CERT NZ’s Critical Controls provides a strong defensive net to detect, prevent and respond to any potential ransomware attack before your data is encrypted.
The diagram references these Controls at the relevant intervention point.
The first phase shows how the attacker looks for ways into the network.
• Security awareness building.
• Patching.
• Multi-factor authentication.
• Password manager.
• Centralised logging.
• Application control.
The second phase shows how the attacker will look to move from the initial computer they compromised and gain administrative access to all the computers and devices in your business.
The Critical Controls referenced are:
• Centralised logging.
• Patching.
• Application control.
• Network segmentation.
• Principle of least privilege.
The third phase shows when the attacker has gained access to the different systems in your business and is now ready to carry out the most damaging part of the attack.
The third phase shows the impact on target which include data exfiltration, destroy back-ups and encrypt data.
The Critical Controls referenced are:
• Backups
• Centralised logging.
• Application control.
Each of the relevant controls is marked by a coloured hexagon:
• Rose for asset lifecycle management.
• Yellow for patching.
• Purple for multi-factor authentication.
• Green for security awareness building.
• Navy for application control.
• Light blue for centralised logging.
• Black for password manager.
• Grey for principle of least privilege
• Pink for network segmentation.
• Gold for backups.
If you're affected by a ransomware attack:
If you do pay a ransom and receive your files back, have the computer professionally inspected by an IT expert to check if the attacker has planted any other malware on the computer, or created another way to access the computer and your data.
The Government has also released guidance on cyber ransom payments.
Cyber ransom advice – Department of the Prime Minister and Cabinet
If you think your business has been impacted by ransomware, report it to CERT NZ.