Encryption speed is not the only ransomware impact
How fast files lock matters far less than what else happened.
The data was copied out first. Backups may have been deleted. Credentials were taken. Systems have to be rebuilt rather than restarted, and regulators have to be told. Focusing on encryption speed measures the most visible moment of an incident whose cost is mostly elsewhere.
More on Ransomware and malware
- Ransomware is often the last stage, not the firstThe bang is the end of the fuse
- Backups are ransomware targetsThe lifeboat goes first
- Lateral movement turns one foothold into manyAlong the loft, house to house
- Command and control gives malware an operatorSomebody is still holding the controller
- Persistence is about surviving changeStill there after the tide
- Living off the land reduces new-tool visibilityThey use your tools, not theirs