Definition
Ransomware is a type of malicious software designed to deny access to a user's data or system until a ransom is paid. It achieves this by encrypting files or locking the entire system, rendering them unusable without a specific decryption key. Attackers typically gain entry through deceptive emails, exploiting unpatched vulnerabilities, or compromising remote access services, then move laterally within the network before deploying the encryption payload. This threat is critical to understand as it can cause catastrophic data loss, significant financial damage, and prolonged operational disruption for any organization. For instance, the WannaCry attack in 2017 rapidly spread globally, encrypting files on hundreds of thousands of computers and demanding payment in Bitcoin. While often confused with viruses or worms, ransomware's defining characteristic is the explicit demand for payment in exchange for restoring access. This topic is frequently tested in cybersecurity certifications like CompTIA Security+ and CySA+ as well as in enterprise security domains like CISSP.