Malware and ransomware: reducing the damage
Updates, restricted access, careful handling of files and recoverable backups are more useful than trying to recognise every piece of malware.
Last reviewed: October 2026
Malware is software designed to steal information, spy on users, disrupt systems or give an attacker access to a device. Ransomware is a particularly disruptive form that can encrypt or destroy data and is often combined with theft and extortion.
You do not need to identify every technical variation. Concentrate on making infection less likely and recovery possible.
Update promptly
Keep operating systems, browsers, applications and security software supported and up to date. Enable automatic security updates where practical. Attackers routinely exploit vulnerabilities for which fixes already exist.
Remove software you no longer need. Unsupported applications and devices accumulate risk because security flaws stop being fixed.
Be cautious with files and software
Unexpected documents, archives, installers and links deserve scrutiny even when they appear to come from someone you know. If a file is unusual or consequential, verify it through another channel.
Only install applications from official app stores or the vendor’s genuine website. Never download pirated software. Don’t add browser extensions unless you’re absolutely sure they’re genuine and supported.
Never disable built-in security controls merely because a document or installer tells you to.
Limit what one compromised account can do
People should normally work without administrator privileges. Give access to shared storage and systems according to need rather than convenience, and remove access promptly when it is no longer required.
Protect administrative and important cloud accounts with strong authentication. A compromised user account should not automatically provide the keys to every system and backup.
Back up what you cannot afford to lose
A synchronised cloud folder is useful, but synchronisation alone is not necessarily a backup: deletion or corruption may be synchronised too.
Keep recoverable copies of critical material. At least one backup should be protected from the same account or system that holds the live data, so an attacker cannot easily destroy both. Use version history or immutable/soft-delete features where available.
Most importantly, test recovery. A backup that has never been restored is an assumption, not a recovery plan.
If you suspect infection
Stop using the affected device for sensitive work and contact your IT/security support. If ransomware is actively spreading in an organisation, rapid isolation can be important, but follow your incident plan rather than improvising if one exists.
Do not erase or rebuild a device before advice if an investigation may be required; useful evidence can be lost.
For productions
Know where rushes, project files, contact information and critical documents are backed up before an incident occurs. Decide who can restore them and how the team would work if the normal cloud service or office network became unavailable.
Resilience is part of security. The question is not only whether an attack can be prevented, but whether the production can recover when prevention fails.