Malware that makes files on a computer unusable, for example by encrypting them, and demands a ransom in exchange for restoring them. Some attackers also threaten to publish stolen data. Backups kept disconnected from the network are an important safeguard.
Japanese name: ランサムウェア
Ransomware appears in 4 practice questions across 2 topics, including Information Security Basics, System Architecture and Reliability.
Field: Information Security Basics
Answer: B. Malware that makes files on a computer unusable, for example by encrypting them without permission, and demands money (a ransom) in exchange for restoring them
Ransomware is malware that makes files on infected computers or networks unusable, for example by encrypting them, and demands a ransom in exchange for the key to restore them. As of the mid-2020s, many reported cases involve intruding into an organization's network and encrypting many servers at once, or threatening to publish data stolen before the encryption (double extortion). Paying gives no guarantee of recovery and funds criminals, so not paying is recommended. The core defenses are applying fixes for vulnerabilities that attackers use to get in, multi-factor authentication for remote access, minimizing privileges, and backups kept somewhere disconnected from the network.
Answer: C. Keep three copies including the original data, store them on two different types of media, and keep one of them in a separate location (such as one disconnected from the network)
The 3-2-1 rule is a guideline for backups: keep at least three copies of the data including the original, store them on at least two different types of media (disk, tape, cloud and so on), and keep at least one of them in a separate location. The idea is that a failure of one device, a defect common to one type of media, or damage at one site such as a fire or disaster should not affect all copies at once. Ransomware may encrypt or delete backups that are connected to the network and writable, so it is important to keep at least one copy offline (disconnected from the network) or set so that it cannot be modified for a certain period (immutable). It is also necessary to confirm regularly through restore tests that the data can actually be recovered when needed.
Ransomware is malware that makes files on infected computers or networks unusable, for example by encrypting them, and demands a ransom in exchange for the key to restore them.
Which statement correctly describes ransomware?Ransomware may encrypt or delete backups that are connected to the network and writable, so it is important to keep at least one copy offline (disconnected from the network) or set so that it cannot be modified for a certain period (immutable).
Regarding backups as a defense against ransomware, which me…When ransomware infection is suspected, first disconnect the PC from the network so that damage does not spread to other PCs or file servers.
On an employee's PC, file extensions start changing one aft…Note that RAID protects against disk failures; data deleted by mistake or encrypted by ransomware is reflected on both disks, so RAID is no substitute for backups.
Which describes RAID 1?As an Amazon Associate I earn from qualifying purchases.
Multi-factor authentication RAID Cross-site scripting (XSS) Digital signature Hash function Message authentication code Phishing Principle of least privilege Public-key cryptography Salt