Malware, ransomware and backups

Malware is any software made to do harm. A virus attaches to other files and spreads when they're shared. A worm spreads by itself across a network through a vulnerability, with nobody clicking. A trojan pretends to be something useful, like a free game or a cracked program. Spyware watches what you do; a keylogger records what you type. A botnet is many infected machines controlled together, often to flood websites with traffic.

Ransomware encrypts your files and demands payment for the key, and today it usually steals a copy first and threatens to publish it too. It's the attack that most often stops whole businesses, hospitals and councils.

Malware mostly gets in three ways: someone opens an attachment or runs a download, an attacker uses a known vulnerability in something that faces the internet (a VPN, an email server, an unpatched website), or an attacker signs in with stolen passwords to remote access that has no second factor. The defences match: training, patching quickly, and MFA on every remote login.

On each computer, endpoint protection (antivirus, or EDR, endpoint detection and response, which also watches for suspicious behaviour) catches much of the rest. Only installing software from trusted sources, and not working day to day as an admin, limits what slips through.

Backups are the answer to ransomware. The 3-2-1 rule: three copies of your data, on two different kinds of storage, with one copy offsite. Keep at least one copy offline or immutable (it can't be changed or deleted for a set time), because ransomware looks for backups it can reach and encrypts them too.

A backup you've never restored is a hope, not a plan. Test restoring files regularly, and know how long a full restore takes. Paying a ransom doesn't guarantee the files come back or that the stolen copy is deleted, and in some places paying certain groups is against the law.