--- title: "How to effectively defend against ransomware — ZEBR.ai" description: "If you follow the recommendations described in this article exactly, you will never pay a ransom, will always get your data back, and will minimize downtime to a duration you are willing to accept." url: "https://zebr.ai/en/blog/how-to-effectively-defend-against-ransomware" markdown_url: "https://zebr.ai/en/blog/how-to-effectively-defend-against-ransomware.md" language: "en" published: "2019-02-08T09:58:14+00:00" alternates: cs: "https://zebr.ai/cs/blog/jak-se-ucinne-branit-ransomwaru.md" sl: "https://zebr.ai/sl/blog/kako-se-ucinkovito-braniti-pred-izsiljevalsko-programsko-opremo.md" sk: "https://zebr.ai/sk/blog/ako-sa-ucinne-branit-ransomveru.md" hr: "https://zebr.ai/hr/blog/kako-se-ucinkovito-obraniti-od-ransomwarea.md" sr-Latn: "https://zebr.ai/sr-latn/blog/kako-se-efikasno-odbraniti-od-ransomwarea.md" bs: "https://zebr.ai/bs/blog/kako-se-ucinkovito-zastititi-od-ransomwarea.md" sq: "https://zebr.ai/sq/blog/si-te-mbroheni-ne-menyre-efektive-nga-ransomware.md" fr: "https://zebr.ai/fr/blog/comment-se-defendre-efficacement-contre-les-ransomwares.md" es: "https://zebr.ai/es/blog/como-defenderse-eficazmente-del-ransomware.md" de: "https://zebr.ai/de/blog/wie-sie-sich-wirksam-gegen-ransomware-schuetzen.md" pt-BR: "https://zebr.ai/pt-br/blog/como-se-defender-eficazmente-contra-ransomware.md" pl: "https://zebr.ai/pl/blog/jak-skutecznie-bronic-sie-przed-ransomware.md" it: "https://zebr.ai/it/blog/come-difendersi-efficacemente-dal-ransomware.md" nl: "https://zebr.ai/nl/blog/hoe-u-zich-effectief-kunt-beschermen-tegen-ransomware.md" hu: "https://zebr.ai/hu/blog/hogyan-vedekezhet-hatekonyan-a-ransomware-ellen.md" ro: "https://zebr.ai/ro/blog/cum-sa-va-aparati-eficient-impotriva-ransomware-ului.md" tr: "https://zebr.ai/tr/blog/fidye-yazilimlarina-karsi-etkili-sekilde-nasil-korunulur.md" id: "https://zebr.ai/id/blog/cara-efektif-melindungi-diri-dari-ransomware.md" --- [Home](https://zebr.ai/en/) [Blog](https://zebr.ai/en/blog) How to effectively defend against ransomware # How to effectively defend against ransomware If you follow the recommendations described in this article exactly, you will never pay a ransom, will always get your data back, and will minimize downtime to a duration you are willing to accept. 08/02/2019 · 10 min read · ZEBR.ai editorial team **If you follow the recommendations described in this article exactly, you will never pay a ransom, will always get your data back, and will minimize downtime to a duration you are willing to accept.** [Video](https://www.youtube.com/embed/VEbkqIf_CHA) ## A few interesting facts • Every day, 20 criminal offences related to cyberattacks are reported in the Czech Republic.\ • The number of attacks has doubled over the past 3 years.\ • Each year, an average of 25% more is paid per attack.\ • Only some organizations prepare for an attack in advance. The others wait.\ • The question is not whether an attack will come, but when it will come. ## What is ransomware Ransomware is malicious code (malware) created for the purpose of enriching the attacker. It works on the principle of extorting users. Affected users are forced to pay to regain access to (decrypt) their own data. ## How ransomware works Once ransomware infiltrates a computer or computer network, it encrypts all data on local disks, external disks, network storage, NAS devices, and data on other machines. Thanks to vulnerable protocols (usually through unpatched systems), ransomware can also reach locations in the network and devices that are otherwise very well secured and usually inaccessible. It is also particularly insidious that encryption does not have to begin immediately after infection, but may start after a delay. Once all data is encrypted, the attacker demands a ransom. Usually, a prompt appears on the monitors of affected machines asking for a certain amount to be paid within a specific period, with a countdown running (for example, pay 5 Bitcoins within 72 hours to a specific Bitcoin account). If you become the victim of a ransomware attack and lose all data, systems, and backups, there is no option left but to pay the ransom. After the ransom is paid, attackers should send a decryption key. Once entered, your data should be decrypted and thus restored to its original form. ## Why is there so much ransomware now and why is it being talked about everywhere? Simply because it works and is a very easy way to make dishonest money by illicit means. While successful ransomware attackers used to be recruited from among very good programmers with a sufficiently corrupt character to enrich themselves in this way, today only the corrupt character is needed. This is because ransomware can be purchased or even rented. So when almost anyone can become a successful attacker, the number of attacks logically increases. ## Do attackers really send working decryption keys after payment? There is no general answer to this. The experience of our customers and partners is mixed. While some paid even several times and subsequently decrypted their data successfully, others never received the keys. It depends on the attack. There are even known cases of obviously “faulty ransomware,” where encryption took place but the payment and communication connection did not work, so decryption did not occur. One piece of advice – try to contact the attacker in advance and ask for proof that they truly control your data. Ask the attacker to decrypt part of the data or provide you with a portion of the damaged data (for example, several files). This will show both whether the attacker can be contacted and whether they can help you at all. If a small amount is demanded – say 100 to 500 dollars (usually a mass attack on a large number of users) – the attacker may not respond, yet decryption keys may still be sent because the process is automated. However, if you are a large or prosperous organization targeted by a focused attack and the requested amount is in the thousands of dollars, the attacker will probably communicate with you in their own interest. Then all that remains is to pay, hope, decrypt, learn from it, and protect yourself against the next attack. ## Can ransomware attack us too? Yes. And if it has not happened yet, it is highly likely to happen very soon. One of the current trends in ransomware is targeting local users and organizations. This increases attackers’ chances of success. Nowadays, few people fall for emails written in poor English that urge them to open a suspicious attachment. But if a company director receives an email from a reputable law firm (the email address is, of course, forged), written in polished legal Czech, stating that due to an unpaid invoice a lawsuit will be filed against the company in the coming days, the director will very likely open the infected attachment supposedly containing the unpaid invoice. And because top management in many companies has full, i.e. administrator, rights configured, encryption can begin. Another common method is attacks through the RDP protocol, where the attacker attempts to brute-force Remote Desktop access. If successful, nothing prevents ransomware from being launched. ## 10 + 1 rules for effective ransomware protection **1)** The most common method of infection is through email and an infected attachment or a link in an email leading to infected content. The very least you can do is configure stricter mail filtering. **2)** Users are the greatest risk. It is not difficult to convince an uninformed user to open an attachment under some pretext. Such an attachment may be, for example, an allegedly unpaid invoice sent to the billing department, an alleged CV sent to the HR department, an alleged order sent to the sales department, or an alleged parcel delivery confirmation. Therefore, do not grant administrator rights to users who should not have them. **3)** Educate users and repeatedly train them in safe behavior. Especially those users with elevated permissions. **4)** Update. An up-to-date system usually means a patched system with fewer vulnerabilities (though not always, of course). Regularly updated systems always have a lower risk of ransomware infection and further spread. **5)** Use active ransomware protection such as antivirus and security software. Or use [active ransomware protection](http://dl.managed-protection.com/u/backup/help/12.5/user/cs-CZ/index.html#38894.html), which is included in all Acronis backup solutions. The advantage of Acronis active protection is that it is specialized directly for ransomware. Active protection can detect and stop ransomware encryption and spread, or at least mitigate the damage caused. In addition, Acronis active protection can automatically restore already encrypted files from the file system cache. On machines where you do not have a paid Acronis backup solution, install at least the free active ransomware protection – [Acronis Ransomware Protection](https://www.zebra.cz/produkt/acronis-ransomware-protection/) (The free active protection included in Acronis Ransowmare Protection is intended only for Windows 7, 8, and 10 operating systems. Active protection in paid Acronis backup solutions also protects server operating systems and virtual infrastructure). **6)** Use passive protection – backups. No active protection guarantees 100% defense against ransomware. It is always a battle between active protection developers and ransomware creators. Active protection only increases the chance of resisting an attack. Therefore, create backups and store them in a safe location. If the worst happens, you can restore data and systems from backups. The condition is that backups are stored “safely”; see points 7 and 8 below. **7)** Protect backups. If ransomware reaches backups (smarter ransomware attempts this first), it will encrypt them mercilessly as well. If you use an Acronis backup solution, you also have active ransomware protection available. Among other things, it prevents backups created by Acronis from being encrypted from infected machines (the so-called Acronis self-defense system). **8)** Hide backups. You do not need to actively protect backups if ransomware cannot reach them. Therefore, do not store backups in repositories that everyone can access. The worst thing you can do is store backups openly right next to users’ data. You need to allocate and separate a space for backups. Permissions must be defined precisely. If you create backups using Acronis software, configure the repository so that only Acronis can access it and credentials secured by a password are required. Do not use this password, and consequently the backup repository, for any other purposes. **9)** Store copies of backups in a place where ransomware cannot harm them. The ideal location is Acronis cloud storage – [Acronis Cloud Storage](https://www.zebra.cz/produkt/acronis-cloud-storage/). Why? Because communication between client devices and cloud storage is implemented using a proprietary mechanism with authentication, including through valid certificates, so there is no chance that ransomware could damage or encrypt backups in the Cloud. This means that even if an organization is under attack and an infected backup is sent to Acronis cloud storage, the other backups stored in the cloud will remain intact. The latest infected backup cannot be used for recovery. However, any other previously created backup whose content is not yet encrypted can be used. Compared with common offsite storage such as public cloud or private cloud, accessible through commonly used protocols, it is clear that opening a connection during an ongoing attack also puts backups stored in secondary storage outside the organization at risk. Furthermore, ransomware may gain access to these repositories just as it can access local storage. Ransomware can therefore encrypt backups stored on the other side of the world. Such secondary storage then protects the organization only against failures of primary backup storage, but unfortunately it is not enough against ransomware. **10)** If you meet all the preceding points, you can sleep soundly. You have a 100% certainty that you will not pay a ransom. You are certain that you will not lose data. You are certain that even if ransomware encrypts half of the organization, you will eventually be able to get systems running again (of course, it will take time). If that is not enough for you, read point 11. **11)** A point for connoisseurs – if you are not willing to tolerate downtime caused by ransomware or another cause (you guarantee continuous operation, operate critical systems, or every hour of downtime generates huge losses), look at the combination of the enterprise backup solution [Acronis Backup](https://www.zebra.cz/produkt/acronis-backup/) and [Acronis Disaster Recovery](https://www.zebra.cz/produkt/disaster-recovery-add-on/). At the moment of a failure (caused, for example, by ransomware), this system can launch critical machines in the Acronis cloud and take over all services that need to remain operational. Once the production environment is restored, you can switch operations back to the organization’s production machines with almost no outage (expect 1–2 minutes offline). Current data from temporarily running cloud machines is uploaded to them in the background, followed by the switch. ## Overview of Acronis ransomware protection solutions - Who the solution is suitable for · Solutions suitable for households · Solutions suitable for organizations - Solution name · [Acronis](https://www.zebra.cz/true-image-2019-srovnani/) [True Image](https://www.zebra.cz/true-image-2019-srovnani/) [Standard](https://www.zebra.cz/true-image-2019-srovnani/) · [Acronis](https://www.zebra.cz/true-image-2019-srovnani/) [True Image](https://www.zebra.cz/true-image-2019-srovnani/) [Advanced](https://www.zebra.cz/true-image-2019-srovnani/) · [Acronis](https://www.zebra.cz/true-image-2019-srovnani/) [True Image](https://www.zebra.cz/true-image-2019-srovnani/) [Premium](https://www.zebra.cz/true-image-2019-srovnani/) · [Acronis](https://www.zebra.cz/produkt/acronis-backup/) [Backup](https://www.zebra.cz/produkt/acronis-backup/) · [Acronis](https://www.zebra.cz/produkt/acronis-backup/) [Backup](https://www.zebra.cz/produkt/acronis-backup/) + [Acronis](https://www.zebra.cz/produkt/acronis-cloud-storage/) [Cloud](https://www.zebra.cz/produkt/acronis-cloud-storage/) [Storage](https://www.zebra.cz/produkt/acronis-cloud-storage/) · [Acronis](https://www.zebra.cz/produkt/acronis-backup/) [Backup](https://www.zebra.cz/produkt/acronis-backup/) + [Acronis](https://www.zebra.cz/produkt/disaster-recovery-add-on/) [Disaster](https://www.zebra.cz/produkt/disaster-recovery-add-on/) [Recovery](https://www.zebra.cz/produkt/disaster-recovery-add-on/) - Paid solution - For protecting computers, workstations and laptops - For protecting servers, virtual and cloud infrastructure - Protection against data encryption and ransomware spread - Creating and storing backups in local and network storage - Protection against Acronis backup encryption - Sending backups to separate Acronis cloud storage · 250 GB · 1,000 GB · As selected by you · As selected by you - Launching an identical copy of a critical machine in the cloud - Moving a current machine copy back into production Solution names – links are located in the upper part of the table (click to go to the relevant solution) ## Do you need specific advice? • Do you need advice on ransomware protection?\ • Are you interested in what such protection could look like for you?\ • Do you want to see with your own eyes how we protect systems at our company? Do not hesitate to contact us at +420 596 912 961, or email us at Source: Article author: ZEBR.ai editorial team Read on ## More related articles [All articles](https://zebr.ai/en/blog) ### [ZEBR.AI: N-able introduces shadow AI identification into its UEM and security solutions](https://zebr.ai/en/blog/zebr-ai-n-able-introduces-shadow-ai-identification-into-its-uem-and-security-solutions) New capabilities provide visibility into the use of AI tools across all endpoints and networks by individual identities, without the need for additional agents or infrastructure 28/09/2026 · 3 min read ### [Acronis: Ransomware can halt production even without attacking PLC systems](https://zebr.ai/en/blog/acronis-ransomware-can-halt-production-even-without-attacking-plc-systems) For manufacturing companies, ransomware is not just a matter of IT security, but a matter of production continuity 23/09/2026 · 3 min read ### [GFI Archiver AI simplifies integration with GFI KerioConnect](https://zebr.ai/en/blog/gfi-archiver-ai-simplifies-integration-with-gfi-kerioconnect) Direct integration of both products makes working with corporate emails easier, improves mail server performance, and enables more effective compliance with regulations 21/09/2026 · 2 min read Contact ## Do you need a solution for yourself or for your client? Tell us which service you are looking into, and a specialist in that area will get back to you directly. [(704) 745-4214](tel:+17047454214)\ --- - Source: - Site overview for AI agents: