The best way to deal with ransomware is to detect it early and prevent it from spreading and disrupting IT systems. If the worst happens and encryption has rendered IT systems inoperable, IT teams can follow three paths to get back to normal.

We can advise on whether paying the ransom is advisable. We are generally against paying the criminals but understand why some organizations see it as the only option. Bear in mind that about 40% of the organizations that pay the ransom never receive a way to decrypt their files. Let our business and security experts advise you before taking this step.

In some cases, system administrators can delete the encrypted files and restore copies from the last good backup. It depends if the ransomware variant is doing selective encryption or encrypting everything. The ransomware will need removing as well for this selective restore approach. In reality, this approach is often unavailable, and the option below will need to be followed.

This is the only surefire approach to get systems back to an operational state. Resetting the device, formatting the drives, reinstalling the operating system, and restoring a backup from before the attack will get systems back to normal. Specialist tools will need to be used to ensure that ransomware does not remain in a place that the reset doesn't clean, as this will allow the ransomware to reinfect the device.