Question 75 - CISA discussion

Ransomware is a type of malicious software that encrypts the victim's data and demands a ransom for its decryption1.Ransomware attacks can cause significant damage to an organization's operations, reputation, and finances1. Therefore, it is important to mitigate the impact of ransomware attacks by implementing effective prevention and recovery strategies.

One of the best ways to mitigate the impact of ransomware attacks is to back up data frequently12345.Data backups are copies of the organization's data that are stored in a separate location or medium, such as an external hard drive, cloud storage, or tape2.Data backups can help the organization restore its data in case of a ransomware attack, without paying the ransom or losing valuable information2.Data backups should be performed regularly, preferably daily or weekly, depending on the criticality and volume of the data2.Data backups should also be tested periodically to ensure their integrity and usability2.

The other options are not as effective as backing up data frequently in mitigating the impact of ransomware attacks.Invoking the disaster recovery plan (DRP) is a reactive measure that can help the organization resume its operations after a ransomware attack, but it does not prevent or reduce the damage caused by the attack3. Paying the ransom is not a recommended option, as it does not guarantee the decryption of the data or the deletion of the stolen data by the attackers.Paying the ransom also encourages further attacks and funds criminal activities14. Requiring password changes for administrative accounts is a good security practice, but it is not sufficient to prevent or recover from ransomware attacks.Ransomware attacks can exploit other vulnerabilities, such as phishing emails, outdated software, or weak network security15.