What Is Ransomware? How It Works and How to Protect Yourself

Picture arriving at work, or opening your laptop at home, and finding every file locked behind a message demanding payment. That's ransomware, and it has hit hospitals, councils, schools and small businesses alike.

I've gathered the key points from the UK's National Cyber Security Centre (NCSC) and CISA, the US cyber agency. This is a defensive guide: what ransomware is, how an attack unfolds, what protects you and who to contact if the worst happens.

Ransomware meaning in plain terms

The NCSC describes ransomware as a type of malware that blocks access to your device and the data on it, usually by encrypting your files. Criminals then demand a ransom in return for decryption. You typically can't open your files, and the attackers may threaten to leak any data they've stolen.

CISA's definition is similar: malware designed to encrypt files on a device, making them and the systems that rely on them unusable. It also describes 'double extortion', where attackers steal data as well and threaten to publish it.

How a ransomware attack unfolds

The NCSC breaks an attack into three broad stages:

1. Access. The attackers get into your network, establish control and plant the encryption software. They may also copy your data.
2. Activation. The malware locks devices and encrypts data across the network.
3. The demand. A notice appears on screen with instructions, usually pointing to an anonymous web page and often asking for cryptocurrency such as Bitcoin.

The first stage can be quiet. By the time the demand appears, the attackers may have been inside the network for some time.

How ransomware gets in

CISA's guidance highlights the weak spots that attackers look for, and they're often ordinary ones:

• Phishing emails, including attachments that carry malware.
• Software and operating systems that haven't been updated, especially anything facing the internet.
• Weak or reused passwords, and accounts without multi-factor authentication.
• Remote access services that are left open when they don't need to be.

None of this needs a clever trick on your side to prevent. It mostly needs good habits applied consistently.

Ransomware protection that makes the biggest difference

The NCSC's first piece of advice is to keep a recent offline backup of your most important files and data. CISA agrees and adds that backups should be encrypted and tested regularly. Its guidance notes that many ransomware variants try to find and delete or encrypt backups they can reach, which is why the 'offline' part matters.

Defence	What it does	Where the advice comes from
Offline backups	Lets you restore files without dealing with the attacker	NCSC and CISA
Regular updates	Closes known weaknesses that attackers use	CISA
Phishing-resistant multi-factor authentication	Stops a stolen password being enough	CISA
Unique, long passwords	Limits the damage if one login leaks	CISA
Staff awareness	Helps people spot and report suspicious emails	CISA

In CISA's guidance, organisations are advised to use passwords of at least 15 characters and phishing-resistant multi-factor authentication for all services, starting with email and remote access. If you want the basics of that second step, my guide to two factor authentication is a good place to begin.

What to do if ransomware hits

Every organisation should have a plan before an incident, not after one. The NCSC suggests using an NCSC-assured Cyber Incident Response provider to handle serious incidents, and it publishes response and recovery guidance. If your organisation is UK-based and has had a cyber incident, you can report it through the government's cyber incident reporting service.

The NCSC's pages also cover response and recovery steps, so it's worth bookmarking them before you need them rather than searching in a panic.

Everyday email habits that reduce ransomware risk

Because phishing is such a common way in, CISA's guidance includes several email-focused steps for organisations. Small teams can borrow the ideas:

• Train people to spot and report suspicious emails, and make reporting easy and blame-free.
• Flag emails that come from outside the organisation, so a message pretending to be the boss stands out.
• Restrict attachment types that commonly carry malware.
• Keep macros disabled in Microsoft Office files received by email.
• Separate administrator accounts from everyday user accounts, so a single click doesn't hand over the keys.

None of these steps is difficult. The aim is to make the easy routes in harder, so an attacker moves on to someone else.

Should you pay a ransomware demand?

The NCSC says that it and UK law enforcement don't encourage, endorse or condone payment. Its reasons: paying doesn't guarantee you'll get your data or computer back, your computer will still be infected, you'd be funding criminal groups, and you're more likely to be targeted again.

That's another reason backups matter. They give you a way forward that doesn't depend on the people who attacked you.

Ransomware and the weaknesses behind it

Defending against ransomware also means closing weaknesses in the software you run. If you're curious about one well-known example, a flaw in how an application handles input, I've explained SQL injection in plain English, including how developers defend against it.

Write about cyber defence for a wider audience

Clear explanations of ransomware help ordinary organisations act sooner, and the topic is always in demand.

Analysts and consultants can look at cybersecurity publications that welcome expert contributors.

Related: crypto blogs that accept guest posts.

Frequently asked questions

What does ransomware do?

It blocks access to your device and files, usually by encrypting them, and then demands a ransom for decryption. Some attackers also steal data and threaten to publish it.

How does ransomware spread?

Common routes in CISA's guidance include phishing emails, out-of-date software, weak or reused passwords and exposed remote access. Once inside a network, it can spread to other devices.

Can ransomware be removed without paying?

Sometimes files can be restored from a clean, offline backup after the infected systems are dealt with. A professional incident response provider can advise on your situation.

Is ransomware a virus?

It's a type of malware. The word virus is often used loosely, but the NCSC and CISA both classify ransomware as malware that encrypts files.

Who should I report ransomware to in the UK?

UK organisations can report cyber incidents through the government's reporting service, and the NCSC offers response and recovery guidance.