Everyone is talking about ransomware these days. And for good reason – it is the fastest growing threat vector we have seen in years. But here is the thing that nobody wants to talk about: most organizations have no idea if they are actually prepared for a ransomware attack.
Enter the ransomware audit.
What is a ransomware audit?
A ransomware audit is a systematic review of your organization’s defenses specifically against ransomware threats. It is not a general vulnerability assessment and it is not a penetration test. It is a focused evaluation of whether your people, processes, and technology can prevent, detect, and recover from a ransomware attack.
What should a ransomware audit cover?
At minimum, a proper ransomware audit needs to evaluate:
- Backup integrity – Do your backups actually work? When was the last time you tested a restore? Are your backups stored offline or can ransomware reach them too? This is the single most important thing. If your backups are compromised, you are paying the ransom. Period.
- Email filtering – Since phishing remains the primary delivery mechanism, how good is your email security? Are you stripping executables? Sandboxing attachments? Blocking macro-enabled documents?
- Endpoint protection – Are all endpoints running current AV/EDR? Are signatures up to date? Is behavioral detection enabled?
- Network segmentation – If one machine gets hit, can the ransomware spread laterally across your entire network? Most organizations have flat networks, which means one infected workstation equals total encryption.
- Patch management – How current are your systems? Many ransomware variants exploit known vulnerabilities that have had patches available for months.
- User awareness – Have your employees been trained to recognize phishing? When was the last phishing simulation?
- Incident response plan – Do you have a documented plan specifically for ransomware? Who makes the decision to pay or not pay? How do you communicate if your email is encrypted?
- Privilege management – Are users running as local admins? Do service accounts have more privileges than they need?
How often should you audit?
At least annually, and after any significant infrastructure change. The threat landscape shifts constantly. What was adequate six months ago might be worthless today.
The organizations that survive ransomware attacks are the ones that prepared for them before they happened. A ransomware audit is not glamorous work, but it is the kind of boring, methodical security practice that actually saves businesses.
Stop buying shiny tools and start auditing your basics.