Ransomware encrypts your business data and demands payment for its release, causing operational paralysis, financial loss, and reputational damage. Prevention requires a layered defence combining employee training, technical controls, and robust backup strategies. If an attack succeeds, a well-practised incident response plan can minimise damage and speed recovery without paying the ransom.
How Does Ransomware Actually Work?
Understanding the attack chain helps you defend against each stage:
- Initial access — phishing emails with malicious attachments, exploited vulnerabilities in public-facing services (RDP, VPN), compromised credentials, or infected software downloads
- Lateral movement — once inside, attackers move through the network, escalating privileges and mapping systems
- Data exfiltration — modern ransomware groups steal data before encrypting it, enabling double extortion (pay or we publish)
- Encryption — the ransomware encrypts files across accessible drives, shares, and sometimes cloud storage
- Ransom demand — a note appears demanding cryptocurrency payment, typically with a deadline after which the amount increases
Common ransomware families targeting Indian businesses include LockBit, BlackCat (ALPHV), and Cl0p, though the landscape changes rapidly.
What Preventive Measures Should Every Business Implement?
A multi-layered approach is essential because no single control is sufficient:
| Layer | Controls |
|---|---|
| People | Security awareness training, phishing simulations, reporting culture, clear acceptable-use policies |
| Advanced email filtering, attachment sandboxing, DMARC/DKIM/SPF, block macros in Office files | |
| Endpoints | EDR (Endpoint Detection and Response), application whitelisting, disable unnecessary services, patch management |
| Network | Network segmentation, firewall rules, disable RDP or require VPN+MFA, DNS filtering |
| Identity | MFA everywhere, principle of least privilege, privileged access management, regular access reviews |
| Backup | 3-2-1 rule (3 copies, 2 media types, 1 off-site), immutable backups, regular restore testing |
| Monitoring | SIEM or managed SOC, 24/7 alerting, threat intelligence feeds |
How Should You Build a Ransomware Incident Response Plan?
Every business needs a documented, practised response plan:
- Detection and alerting — define how ransomware will be detected (EDR alert, user report, monitoring system) and who gets notified
- Containment — isolate infected systems immediately; disconnect from network but do not power off (forensic evidence may be in memory)
- Assessment — determine scope: which systems, data, and backups are affected; identify the ransomware variant
- Communication — notify leadership, legal, affected customers/partners, and law enforcement (CERT-In in India, which mandates 6-hour incident reporting)
- Recovery — restore from clean backups; rebuild compromised systems; change all credentials
- Post-incident — conduct root cause analysis, update defences, and document lessons learned
Should You Pay the Ransom?
The near-universal recommendation from security experts and law enforcement is do not pay:
- Payment does not guarantee data recovery — some groups provide broken decryptors or demand additional payment
- Payment funds criminal operations and marks you as a willing payer for future attacks
- Paying may violate sanctions regulations if the group is on a sanctions list
- Even after paying, stolen data may still be published or sold
The only reliable protection against ransomware is prevention and tested backups. If your backups are compromised, consult with cybersecurity professionals and law enforcement before making any payment decisions.
What Are Ransomware Considerations Specific to Indian Businesses?
- CERT-In reporting — under India’s 2022 cybersecurity directives, incidents must be reported to CERT-In within 6 hours
- DPDP Act obligations — data breaches involving personal data trigger notification requirements under the Digital Personal Data Protection Act
- Cyber insurance — growing availability in India; review coverage for ransomware specifically, including business interruption
- MSMEs at risk — smaller businesses often lack dedicated security teams, making managed security services (MSSP) a practical option
What is the average cost of a ransomware attack?
Costs extend far beyond the ransom demand itself. Businesses face downtime (often days to weeks), data recovery expenses, legal and compliance costs, customer notification, reputational damage, and increased insurance premiums. The total impact for mid-sized businesses is often measured in crores when all direct and indirect costs are counted.
Can cloud-hosted data be affected by ransomware?
Yes. If ransomware gains access to cloud credentials or synced folders, cloud-stored data can be encrypted. However, most cloud providers offer versioning and retention policies that can aid recovery. Enable versioning, configure retention locks, and ensure cloud backups are isolated from compromised credentials.
How often should ransomware response plans be tested?
At minimum, conduct a tabletop exercise (simulated scenario discussion) twice a year and a full technical drill annually. Update the plan after every test, significant infrastructure change, or actual incident. Include key stakeholders beyond IT: legal, communications, finance, and executive leadership.
