Learning Ransomware Response & Recovery

Chapter 6. Get Ready for Battle

This book starts from an “assume breach” position, which means that we assume that you are going to get attacked. We do that for several reasons. First, there are many books that will attempt to explain how to prevent ransomware. So we didn’t feel another book on that topic would be helpful. In contrast, there didn’t appear to be another book like this one—a book specifically designed to help you respond to a ransomware attack.

Finally, and perhaps most importantly, we believe the chances of successfully defending yourself against every ransomware attack are virtually nil. To do that, you would have to be successful at defense 100% of the time; the threat actors only have to be successful once. Their chances of success are much greater than your chances of success. It reminds me of the hilarious posters from despair.com, one of which is called DEFEAT. It says “For every winner, there are dozens of losers. Odds are you are one of them.”

Therefore, since your odds of needing to respond to a ransomware attack are very high, you should simply assume that you’re going to be attacked and prepare accordingly. In other words, like this book, you should begin from an assume breach position. It’s simply the most logical starting point when beginning a ransomware defense strategy. Before your organization is infected with ransomware, take the time to follow the suggestions of this chapter.

We have created a companion site, StopRansomware.com, that can help ...