How to keep your files safe from ransomware

Practical steps to ensure that you don't have to pay a ransom for your data, especially as there's no guarantee it will come back

Ransomware remains one of the biggest ongoing threats to the cyber security of both businesses and private individuals, thanks to the fact that it’s cheap and easy to deploy, and it can have devastating consequences for victims.

As the name implies, ransomware is a type of malware that attempts to extort money from its victims. It does this by encrypting all the personal data and documents that it finds on your PC, then demanding that you send money (typically in the form of untraceable bitcoins) in exchange for the decryption key. If you don't pay up, it may be impossible to recover your files.

What should I do if I'm hit by ransomware?

Your first step should be to go online and see whether a free decryption tool is available. Kaspersky Lab is one security publisher that maintains an archive of unlockers for a wide variety of ransomware strains - you can find it at noransom.kaspersky.com.

Unfortunately, it's not always possible to decrypt locked files. The most virulent ransomware attacks - such as the WannaCry worm that hit the NHS earlier back in 2017 - use a freshly generated AES key for every file they encrypt. In a situation like this, it really pays to have backups: if you can restore recent copies of your files from a cloud server or a network volume, you can simply overwrite the encrypted versions and carry on.

If your encrypted files are in a cloud folder like Dropbox or Google Drive, you may be able to go to the website and restore earlier, non-encrypted versions. Just be sure to disinfect your system first, to make sure that the ransomware doesn't simply step in and re-encrypt the restored copies.

What if you don't have recent backups?

An illustration of a man sitting at a desk using a computer, with his local files being backed up to a server and the cloud

If you can’t restore your files on your own, you may be tempted to simply pay the ransom. That may sound like a sensible idea - and on one level it is. It’s a quick and easy solution: ransomware distributors generally provide working decryption keys quite promptly after receiving your payment. After all, it's in their interest to do so, to encourage other victims to pay up.

As tempting as this may be, simply ponying up to get your files back is never advisable. For starters, this funds the criminals behind the attack and allows them to target more victims (as well as potentially funding more actively harmful activities such as drug dealing or human trafficking), perpetuating the cycle of attacks. 

There’s also no guarantee that you’ll get your files back at all. Some ransomware attacks, such as NotPetya, don’t even include a mechanism for decrypting files, and even those that do leave you at the mercy of hackers, who may simply decide not to honour their promise. They may also keep a copy of your data for use in later extortion attempts, as has been seen in the past.

Paying the ransom may sound like the safer and more expedient option, but it’s a false friend; wherever possible, it’s better to simply accept the loss of data, rather than feeding the perpetrators responsible.

How can I prevent a ransomware attack?

The good news is that, if you're reading this, you're probably the sort of person who takes security seriously, and has a reputable, regularly-updated security suite installed on their PC. If that's the case then you're already very well protected against ransomware. While its modus operandi may be distinctive, ransomware is just a type of malware, and any antivirus program worth its salt should be able to identify and block it before it has a chance to meddle with your files.

That said, no form of protection is perfect, and it's possible that a new strain of ransomware might manage to fly under the radar. To protect you against that eventuality, some security suites also include a folder-watching feature, which keeps an eye on the locations typically targeted by ransomware, such as your Documents folder. If any unrecognised process tries to touch these files, you'll be alerted and asked if you want to grant access. Say no and the ransomware is stymied.

Should all else fail, your final line of defence is a good, frequently refreshed set of backups. Just be warned that some ransomware is sneaky, and will target not only the files on your hard disk, but also the contents of external drives and NAS appliances. You might discover too late that your backups have been encrypted along with your day-to-day files. For maximum protection, it's best to use a cloud-based backup system that can't be accessed through Windows Explorer - not by you, and not by any meddling malware.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

New ransomware group is attacking US firms and educational establishments
ransomware

New ransomware group is attacking US firms and educational establishments

15 Jul 2021
Interpol calls for more action to prevent "ransomware pandemic"
cyber security

Interpol calls for more action to prevent "ransomware pandemic"

13 Jul 2021
84% of organizations experienced phishing or ransomware attacks in the last year
ransomware

84% of organizations experienced phishing or ransomware attacks in the last year

12 Jul 2021
Best ransomware removal tools
ransomware

Best ransomware removal tools

9 Jul 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021