What is Ransomware?
Ransomware, told as a story about a thief who locks every chest in the castle and charges for the key.
Every room in the castle has a chest.Books, mail, ledgers, photos. The castle runs on opening them every day.
The thief puts his own lock on every chest.Nothing is taken — it's all locked. Only the thief has the key.
Ransomware locks your things and charges for the key.The castle stops. Paying doesn't guarantee a key. These days they steal a copy before locking, too.
Spare chests far away, and the key doesn't matter.Copy everything to a depot far away, every day. Split the hallway so the thief can't reach it, and let the dog bite the hand that locks.
Paying doesn't guarantee the key.The key may never come, or open only half. A spare depot still connected to the castle gets locked too — so keep it apart, and test that it opens.
Ransomware = a thief puts his own lock on every chest and charges for the key. Nothing is stolen; everything is unusable. The real defense is spare chests far away.
WannaCry stopped hospitals and factories in 2017. Backups follow 3-2-1: three copies, two kinds of media, one far away. And test that they open.
When grown-ups say it
- Encryption
- The thief's lock. The same trick as the seal — but the thief holds the key.
- Ransom note
- The note. So much gold (crypto) within so many days. Late, and the price rises.
- Initial access
- The way in. A fake letter, the tunnel mouth, an open door. Cheapest to stop here.
- Lateral movement
- Locks from room to room. Why it never stops at one chest. → the hallway watcher
- Double extortion
- Steal a copy and threaten to publish. The trick that makes you pay even when you have spares.
- 3-2-1 backup
- Three spare chests. Three copies, two kinds of media, one far away.
- Offline · immutable backup
- The depot the thief can't reach. Kept apart from the castle, or locked so nobody can change it.
- Restore drill
- Testing that it opens. Having a spare and being able to open it are two different things.