Ransomware Attacks – Tips From The Trenches

Ransomware attacks are an increasingly common and serious risk for Canadian organizations of all kinds and sizes. The Canadian Centre for Cyber Security's National Cyber Threat Assessment 2023-2024 warns: "... ransomware is almost certainly the most disruptive form of cybercrime facing Canadians". This bulletin provides practical suggestions, based on real-world experience, for responding to a ransomware attack.

Ransomware attacks

Ransomware is malicious software that prevents access to or use of an infected information technology system or device (an "IT Resource") or related data, and demands (typically through an on-screen ransom note) a ransom for a decryption key to restore the infected IT Resource or data. There are two basic kinds of ransomware – "locker" ransomware (which prevents use of an IT Resource by locking the user interface) and "crypto" ransomware (which encrypts specific files or data so they cannot be used without the required decryption key).