3 ms·

How do you prevent your system from a ransomware attack? If the user is using Windows 10 Professional and doesn't have admin access, can they still be a victim

How do you prevent your system from a ransomware attack? If the user is using Windows 10 Professional and doesn't have admin access, can they still be a victim of a ransomware attack?

kodablah 7y ago
> How do you prevent your system from a ransomware attack? You don't (well, not with 100% certainty anyways), you mitigate the harm.
PeterisP 7y ago
Sure, that user can encrypt all the documents that they have access to and care about, so that can be the target of a ransom. Also, in many smallish organizations users have access to e.g. a common network share, so in the absence of proper backups, a single compromised user (e.g. the owner/manager's administrative assistant with access to all kinds of documents) may be able to seriously disrupt the whole organization.
nradov 7y ago
You prevent users from running untrusted applications. Only whitelisted applications can execute. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...
- Cheyana 7y ago
  I don't see how this would help when all of this ransomware is usually a javascript dropper that gets in through the browser, encrypts files, and then gets out after the damage is done. The only thing that ever saved us in the half dozen or so times that we've been hit is a robust backup system.
  - nradov 7y ago
    Are you certain that was the attack vector, and if so which specific browser vulnerability was it? I'm not aware of any browser JavaScript sandbox escape vulnerabilities that would allow file write access since about 2015. While it's remotely possible there is a zero-day vulnerability being exploited out there it seems highly unlikely. If your organization has been hit multiple times by similar problems then the IT management must be terribly incompetent.
bobbylarrybobby 7y ago
For starters, have reliable backups. If you can just go offline for a day or two, wipe your system, restore, and come back online, you have little reason to pay the ransom.

How do you prevent your system from a ransomware attack? If the user is using Windows 10 Professional and doesn't have admin access, can they still be a victim of a ransomware attack?

kodablah 7y ago

> How do you prevent your system from a ransomware attack? You don't (well, not with 100% certainty anyways), you mitigate the harm.

PeterisP 7y ago

Sure, that user can encrypt all the documents that they have access to and care about, so that can be the target of a ransom. Also, in many smallish organizations users have access to e.g. a common network share, so in the absence of proper backups, a single compromised user (e.g. the owner/manager's administrative assistant with access to all kinds of documents) may be able to seriously disrupt the whole organization.

nradov 7y ago

You prevent users from running untrusted applications. Only whitelisted applications can execute. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...

Cheyana 7y ago
I don't see how this would help when all of this ransomware is usually a javascript dropper that gets in through the browser, encrypts files, and then gets out after the damage is done. The only thing that ever saved us in the half dozen or so times that we've been hit is a robust backup system.
- nradov 7y ago
  Are you certain that was the attack vector, and if so which specific browser vulnerability was it? I'm not aware of any browser JavaScript sandbox escape vulnerabilities that would allow file write access since about 2015. While it's remotely possible there is a zero-day vulnerability being exploited out there it seems highly unlikely. If your organization has been hit multiple times by similar problems then the IT management must be terribly incompetent.

bobbylarrybobby 7y ago

For starters, have reliable backups. If you can just go offline for a day or two, wipe your system, restore, and come back online, you have little reason to pay the ransom.