Ransomware is a type of cyberattack which specifically sets out hold a company’s IT or data to ransom, and it’s a rapidly growing threat. It can be both highly lucrative and alarmingly straightforward for criminals to carry out. Ransomware can be acquired online, and ransomware as a service has entered the cybercrime vocabulary. We explore ransomware in more detail in another blog post. 

Ransomware defeats castle-and-moat security by finding ways past perimeter security. Once it has breached the perimeter it effectively wanders around the ‘castle’ undetected, watching, learning and looking for vulnerabilities it can exploit, for example harvesting administrator passwords or learn ways into secure zones.

Ransomware perpetrators have found many ways to breach perimeter security, from advanced malware, perhaps inserted into a legitimate API or external software, to duping or coercing employees with cleverly disguised phishing attacks or even blackmail.

Potentially high returns and sophisticated and easily available ransomware tools are driving a sharp increase in ransomware attacks. The head of the UK GCHQ recently cited that UK ransomware attacks have doubled in the past year.

It seems clear that dealing with the ransomware threat requires a move away from the traditional castle-and-moat security model.