Ransomware Defense: Detection, Prevention and Recovery

Introduction

Ransomware encrypts your data and demands payment for decryption. Modern ransomware operators are sophisticated — they spend weeks mapping your network before striking, exfiltrate data for double extortion, and target backups first. Defense requires a layered approach.

The Attack Chain

Understanding how ransomware works helps you block it:

Initial Access: Phishing email, exposed RDP, VPN vulnerability, supply chain
Persistence: Create admin accounts, disable security tools, install backdoors
Lateral Movement: Spread through network using stolen credentials
Discovery: Map network, find backup systems, domain controllers
Impact: Disable backups, encrypt everything simultaneously

Backup Strategy: The 3-2-1-1-0 Rule

The most important defense is immutable, tested backups:

3 copies of data
2 different storage types (disk + tape, or disk + cloud)
1 offsite copy
1 offline/immutable copy (air-gapped or immutable cloud storage)
0 unverified backups — test restores regularly

Immutable Backups Setup

BASH

# AWS S3 with Object Lock (WORM - Write Once Read Many)
aws s3api create-bucket --bucket company-backups --region us-east-1
aws s3api put-object-lock-configuration   --bucket company-backups   --object-lock-configuration   '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":30}}}'

# Veeam: enable immutable backups to S3-compatible storage
# In Veeam: Edit job → Storage → Object Storage → Enable "Make recent backups immutable for X days"

Offsite Backup with Rclone

BASH

# Install rclone
curl https://rclone.org/install.sh | bash

# Configure remote (S3, Backblaze B2, Wasabi, etc.)
rclone config

# Sync backups offsite
rclone sync /backup/local remote:bucket-name/server1/ --progress

# Cron job: daily offsite sync
0 2 * * * /usr/bin/rclone sync /backup/local remote:bucket-name/server1/ --log-file=/var/log/rclone.log

Endpoint Protection

BASH

# Linux: Install ClamAV antivirus
apt install clamav clamav-daemon
systemctl start clamav-freshclam
systemctl start clamav-daemon

# Scan directory
clamscan -r /home --log=/var/log/clamav-scan.log

# Real-time scanning with clamd
# Configure /etc/clamav/clamd.conf:
# OnAccessIncludePath /home
# OnAccessExcludeRootUID yes

Network Segmentation

Ransomware spreads laterally. Segmentation limits blast radius:

BASH

# Separate VLANs for:
# - User workstations (VLAN 10)
# - Servers (VLAN 20)
# - Backup systems (VLAN 30 — most restricted)
# - Management (VLAN 99)

# Firewall rules between VLANs:
# Workstations cannot initiate connections to backup VLAN
# Backup VLAN: only backup server IPs can connect

iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.30.0/24 -j DROP  # Block workstations → backups

Disabling Common Attack Vectors

BASH

# Disable RDP if not needed (major ransomware entry point)
systemctl stop xrdp
systemctl disable xrdp

# Block SMBv1 (used by EternalBlue/WannaCry)
# Windows: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
# Linux Samba:
# /etc/samba/smb.conf: min protocol = SMB2

# Restrict PowerShell (Windows) — require signed scripts
# Set-ExecutionPolicy AllSigned

# Disable macros in Office files
# Group Policy: User Config → Admin Templates → Microsoft Office → Security

Detection: Honeypot Files

Place "canary" files that should never be accessed. Alert immediately if touched:

BASH

# Create honeypot files in common ransomware targets
touch /shared/finance/DO_NOT_OPEN_CANARY.docx
touch /shared/hr/DO_NOT_OPEN_CANARY.xlsx

# Monitor with inotifywait
inotifywait -m /shared -e access,modify -r |
while read path action file; do
  if echo "$file" | grep -q "CANARY"; then
    echo "ALERT: Ransomware canary accessed! $path$file" | mail -s "RANSOMWARE ALERT" security@company.com
  fi
done

Incident Response Plan

Document before an incident occurs:

TEXT

1. ISOLATE: Disconnect affected systems from network immediately
   - Don't turn off — forensics needs memory
   - Block at switch port level if possible

2. IDENTIFY: Determine scope
   - Which systems are encrypted?
   - What was the entry point?
   - Are backups intact?

3. CONTAIN: Prevent further spread
   - Change all admin passwords
   - Revoke compromised credentials
   - Disable affected accounts

4. RECOVER: Restore from backups
   - Restore to clean hardware/VMs
   - Test before reconnecting to network
   - Patch the vulnerability first

5. REPORT: Notify stakeholders
   - Management, legal, insurance
   - Regulatory bodies if required (GDPR, etc.)
   - Law enforcement (FBI IC3, local police)

Security Hardening Checklist

BASH

# 1. Enable Windows Defender / Linux auditd
systemctl start auditd
auditctl -w /etc -p wa -k config-change

# 2. Disable unnecessary services
systemctl disable telnet rsh cups

# 3. Enable application whitelisting (Linux: AppArmor)
systemctl enable apparmor
aa-enforce /etc/apparmor.d/*

# 4. Password policy
# /etc/security/pwquality.conf
minlen = 14
minclass = 3
maxrepeat = 2

Summary

Backups are your most important defense — use 3-2-1-1-0 rule with immutable copies
Segment networks so ransomware can't spread from workstations to servers to backups
Patch systems quickly — most ransomware exploits known vulnerabilities
Train users on phishing — it's still the #1 entry point
Practice your incident response plan before you need it