0

I am thinking about ways of protecting against ransomware other than backing up all data. So i thought is there such service which could scan trough emails and find does email contains links or other ways to be infecter by ransomware?

  • 4
    It's called an antivirus program. And if it worked in every case, ransomware would not be an issue. – Ben Dec 7 '16 at 20:12
  • 2
    Email is not the only way to be infected with ransomware. And nothing can be 100% effective. The only protection against ransomware is to have offline and/or versioned backups. – Julian Knight Dec 7 '16 at 21:08
2

Many mail providers scan by default for mails containing malicious code or links. Also browsers use blacklists like Google Safebrowsing to protect the user. And many enterprise firewalls try to protect their users as do local antivirus products. But, none of this is fully reliable so you should still use backups as an additional protection. Apart from that these backups also protect against hardware malfunctions (dead hard disk) or accidental data loss (i.e. delete the wrong file) so you should have such backups anyway.

  • 3
    It should be noted that you need the right kind of backups to protect against ransomware. Just backing up files isn't enough. You need multi-versioned backups so that if (when) your backup program backs up the encrypted versions of the files, you can roll back far enough to unencrypted versions. – Julian Knight Dec 7 '16 at 21:11
  • along that line, backing up to DVD[-+]R (or any write-once media) ensures your backups stay unaffected. cloud-based is probably fine as well, depending on the service's revision history keeping. – dandavis Dec 7 '16 at 22:24
1

Agree with everything posted so far, there is no such magic API. Quickest win with all the cases I dealt with so far was to block word macros on the mail gateway and in the organization GPO.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.