Ransomware
Ransomware is malicious software that blocks access to data or systems, usually through encryption, and demands payment for restoring access.
Cryptovirology: The study of how cryptography can be used in malicious software. Ransomware applies cryptographic techniques to make data inaccessible to its owners.
Incident response: The organized process for detecting, containing, analyzing, and recovering from cybersecurity incidents. Ransomware response prioritizes containment, evidence preservation, and safe restoration.
Wiper malware: Malicious software designed to destroy data or make systems unusable, rather than enable recovery through payment. Unlike typical ransomware, a wiper may offer no genuine path to restore encrypted data.
Data breach: An incident in which sensitive, protected, or confidential information is accessed or disclosed without authorization. Ransomware campaigns that steal data can expose victims even after systems are restored.
Public-key cryptography: Cryptography using mathematically linked public and private keys for encryption and digital signatures. Many ransomware families encrypt files so only an attacker-held private key can unlock them.
Backup: A separate copy of data kept for recovery after loss, corruption, or damage. Clean, offline backups can restore encrypted files without relying on an attacker’s decryptor.
Locker ransomware: Ransomware that blocks access to a device or interface without necessarily encrypting files. It is a distinct form of ransomware whose primary lockout may target the system itself.
Business continuity: An organization’s ability to maintain or promptly resume essential operations during disruption. Ransomware can halt critical services, making continuity plans as important as file recovery.
Phishing: A deceptive attempt to obtain information or induce actions by impersonating a trusted source. Phishing messages often trick victims into launching ransomware or exposing credentials.
Endpoint detection and response: Security technology that monitors endpoint activity and supports investigation and response to threats. Behavioral detection can identify mass file changes and suspicious execution before encryption spreads.