Ransomware encrypts the files on a machine, then spreads across the network. In a bank branch, a town hall or a head office, work stops dead: no client files, no business applications, sometimes no phones.
Successful attacks are rarely sophisticated. They almost always take one of these five routes.
1. The email attachment
An invoice, a CV, a payment advice. The file has a plausible name and sometimes arrives from a known address whose mailbox has been compromised. The user opens it, and that is that.
What helps: filtering at the mail gateway, blocking macros by default, and above all behavioural analysis on the endpoint — a document that triggers mass encryption is recognised by its behaviour, not its signature.
2. The USB stick
Still widely used to move files between poorly connected sites. A stick that travels between a personal machine and a work machine also carries whatever it picked up along the way.
What helps: a device control policy. Blocking everything is rarely sustainable; allowing registered devices, scanning automatically on insertion and logging connections is a workable compromise.
3. Poorly protected remote access
An administration port exposed to the internet with a weak password is found within hours by bots scanning continuously. It is a major vector, and it requires no carelessness from any user.
What helps: no administration access exposed directly, a VPN, two-factor authentication, and rate limiting on login attempts.
4. The forgotten machine
A computer in a remote branch, switched on once a month, that has not been updated in a year. It is vulnerable to flaws that have been known and patched for a long time.
What helps: a central console giving visibility across the whole estate. You cannot protect what you cannot see — and the real coverage rate often holds surprises.
5. The reused password
A work password also used on a third-party site, which then suffers a breach. The credentials end up in lists that are resold and tested systematically.
What helps: two-factor authentication on sensitive access, which makes a stolen password largely unusable.
Preparing for the worst
No protection is absolute. The question is not only how to stop the attack, but how to recover afterwards.
- Offline or immutable backups: a backup reachable from the network is encrypted along with everything else.
- A tested restore. A backup you have never restored is an assumption, not a guarantee.
- A written plan: who isolates the network, who informs management, who speaks to clients. Under pressure, nobody improvises well.
In short
These five doors close with accessible measures: up-to-date antivirus managed from a console, a USB policy, protected remote access, and tested backups. None requires a large budget — they require consistency.
Scoolis deploys eScan across endpoints and servers, for businesses and consumers alike. Explore endpoint protection.