Top Methods to Protect Your Company from Ransomware

Ransomware is malicious software that encrypts a victim’s files and demands payment for the decryption key, and it remains one of the most financially damaging cyberattack categories organizations face today. Every organization, regardless of size, is a potential target: the July 2021 Kaseya attack demonstrated how a single compromised software vendor can cascade ransomware to thousands of downstream customers through trusted update channels. Protecting your company requires a layered defense strategy that addresses multiple attack vectors simultaneously. The recommended action: implement proper certificate and key management as your first priority, encrypt data at rest with envelope encryption, store keys in HSMs, maintain tested offline backups, and train employees to recognize phishing. This guide uses the Kaseya attack as a case study, covers eight ranked ransomware protection methods, and provides a detection and remediation checklist. For the broader ransomware context, see Decrypting Ransomware: Understanding How Cybercriminals Hold Your Data Hostage.

Quick Answer: What Are the Top Methods to Protect Against Ransomware?

The top methods to protect your company from ransomware are: (1) implement certificate and key lifecycle management with automated monitoring to prevent rogue certificate abuse; (2) use envelope encryption on data at rest so stolen data remains unreadable even after decryption of the data layer; (3) store all encryption keys in FIPS 140-2 Level 3 or higher HSMs; (4) protect data in motion with SSL/TLS; (5) maintain a tested Disaster Recovery Plan with offline backups; (6) train employees to recognize phishing and social engineering; (7) deploy PKI for device and user authentication; and (8) patch all software and hardware promptly and deploy anti-malware software with behavioral detection. The most critical single control is having tested offline backups, because that control removes the attacker’s primary leverage regardless of how the infection occurred.

Case Study: The Kaseya Attack (July 2021)

On July 2, 2021, Kaseya, an IT solutions provider that offers software to Managed Service Providers (MSPs) and enterprises, announced that an attack had hit their VSA (Virtual System Administrator) tool and affected a small number of on-premises customers. Although only a small number of direct Kaseya customers were affected, each of those customers was an MSP with their own downstream business clients. As a result, hundreds of smaller businesses were also compromised by this supply chain ransomware attack.

This attack followed other major ransomware incidents in the preceding months, including the Colonial Gas Pipeline attack and the attack on meat supplier JBS. These incidents together demonstrated that ransomware had moved from targeting individual organizations to targeting the software supply chain, where a single successful compromise could cascade to thousands of victims through trusted distribution channels.

How the Attack Worked

The attack manipulated an authentication bypass vulnerability within Kaseya’s VSA web interface. The attackers bypassed security controls, uploaded their payload, and used SQL injection to execute their code. Once the endpoint of the MSP was infected, the endpoint wrote a file into its working directory. The machine then ran PowerShell commands to disable malware protection services on the Windows computer. The file was then executed as ransomware.

The critical element was the use of a rogue certificate. The attackers used a certificate belonging to an organization called PB03transport, indicating that they had obtained that organization’s private key, most likely through phishing or a man-in-the-middle attack. They used this certificate to sign the ransomware payload, making it appear as a legitimate, trusted software update. Once an MSP was infected, the malware distributed itself to other customers through an automated update containing the ransomware. The ransomware in question was REvil (also known as Sodinokibi).

The sad truth of this attack is that it could have been prevented. With proper certificate monitoring and key inventory management, the stolen private key could have been detected and deactivated before it was used to sign the malicious payload. A managed certificate lifecycle management system or PKI-as-a-Service would not have allowed this rogue certificate to be created and go undetected. For the broader ransomware supply chain context, see Nvidia Code Signing Certificates Stolen by Ransomware Group.

What Is Ransomware and How Does It Work?

Ransomware is a type of malware that encrypts all the files in a victim’s system. Methods of infection include phishing emails, malicious ads, drive-by downloads, compromised software, and exploitation of unpatched hardware or software vulnerabilities. Once the ransomware is successfully deployed, all documents, files, and data on the victim’s systems are encrypted. The attackers leave a ransom note with instructions on how much to pay and where, in exchange for the decryption key.

It is not recommended to pay ransomware threat actors. They may not provide the decryption key after receiving payment. They may have already downloaded the unencrypted data to use for future blackmail. And paying funds future attacks. One of the most effective protections is encrypting your data before an attack occurs: if the data on your network is already encrypted with envelope encryption and the attacker does not have access to the master encryption key, then any data they steal is useless to them, removing their blackmail leverage.

Top Methods to Protect Your Company from Ransomware

• Implement proper certificate and key management

  The Kaseya attack demonstrated what can happen when a stolen private key goes undetected and is used to sign malicious software. Rogue certificates can be used to spread all types of malware, making certificate and key management a foundational ransomware protection control. Automating key and certificate management lifecycle tasks, such as renewal, creation, and revocation, ensures that no certificate exists in your environment without active monitoring. Continuously identifying and inventorying all certificates in your network, including shadow certificates discoverable via Certificate Transparency logs, allows you to detect and revoke any rogue certificate before it can be used. See CertSecure Manager for automated certificate lifecycle management.

• Utilize envelope encryption

  Encrypting your organization’s data at rest is one of the most effective protections against the blackmail leverage that ransomware relies on. Envelope encryption takes this further: it encrypts data with a data encryption key (DEK), and then encrypts that DEK with a master key (KEK) stored separately. Even if a threat actor steals both the encrypted data and the data encryption key, they still cannot decrypt the data without the master key. This means that a successful ransomware infection cannot be used for double-extortion because the stolen data is already encrypted in a form the attacker cannot reverse without the master key.

• Use HSMs for encryption keys

  Hardware Security Modules (HSMs) are external devices used to store cryptographic keys securely. HSMs are tamper-proof, tamper-evident, and resistant to the majority of key extraction attacks. Unlike software-based key storage, an attacker who gains root access to a host server still cannot extract private key material from a properly configured HSM. HSMs also make the organization FIPS 140-2 Level 3 compliant, demonstrating to customers and regulators that cryptographic key protection meets a certified security standard. For scalable HSM deployment, see HSM-as-a-Service.

• Use SSL/TLS for data in motion

  To protect data in transit, most organizations use SSL/TLS (Secure Sockets Layer / Transport Layer Security). SSL/TLS encrypts data using digital certificates and keys, protecting data from interception while it moves between systems. Enforcing TLS 1.3 across your environment, disabling deprecated protocol versions, and maintaining strong cipher suite configurations ensures that data in transit is protected even if attackers gain access to network traffic. For ransomware specifically, protecting internal east-west traffic (system-to-system within the network) is as important as protecting external communications.

• Have a Disaster Recovery Plan in place

  If a ransomware attack succeeds and your data is encrypted, having a tested Disaster Recovery Plan (DRP) is the control that makes the difference between paying the ransom and recovering without it. The DRP must include: clean, tested, offline or air-gapped backups of all critical data; documented restoration procedures tested under simulated ransomware conditions; clearly defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs); a communication plan for notifying stakeholders during recovery; and a regular testing schedule. A plan that has never been tested is not a functional DRP. Regular updates and tests ensure that the plan works when needed and that the backups are complete and uncorrupted.

• Train your team members

  One of the most common initial access vectors for ransomware is phishing: emails or messages that trick team members into clicking malicious links, opening infected attachments, or entering credentials on fraudulent websites. Training team members not to click malicious ads or links, teaching them to verify unexpected email senders before opening attachments, and establishing clear procedures for reporting suspicious communications can significantly reduce the success rate of phishing campaigns. Ongoing security awareness training, combined with simulated phishing exercises, builds organizational resilience against this attack vector.

• Protect your systems with PKI

  A Public Key Infrastructure (PKI) ensures that unknown devices cannot access your company’s network. PKI uses digital certificates to verify that devices and users can be trusted within a network. As long as certificate and key management practices are properly implemented, any user or device with a valid PKI certificate can be trusted and any without cannot connect. This prevents attackers who have obtained compromised credentials from accessing network resources if their device does not hold a valid certificate, and it limits lateral movement within the network after an initial compromise. For PKI implementation, see PKI Services.

• Patch vulnerabilities and use anti-malware software

  Regularly patching vulnerabilities ensures attackers cannot exploit known hardware or software weaknesses to enter your network. The Kaseya attack exploited an unpatched authentication bypass vulnerability; applying available patches promptly reduces the window of opportunity for such exploitation. Operating system and software patches are released when vulnerabilities are identified, so apply them as soon as possible, prioritizing internet-facing systems and critical infrastructure. Anti-malware software with behavioral detection capabilities can detect ransomware behavior patterns (mass file encryption, shadow copy deletion, C2 communication) before encryption completes, alerting the incident response team and enabling containment before the full impact is realized.

Ransomware Protection: Decision Table by Attack Vector

Attack Vector	Primary Risk	Most Effective Protection	EC Product / Service
Supply chain: compromised software update signed with stolen certificate	Trusted update delivers malware to all downstream recipients	Certificate lifecycle management with continuous monitoring; detect and revoke stolen keys before they are used	CertSecure Manager
Phishing: employee clicks malicious link or attachment	Malware payload delivered to endpoint; credential theft enabling lateral movement	Employee training; multi-factor authentication; email filtering	Security awareness training program
Unpatched vulnerability: exploit of known CVE in internet-facing service	Unauthenticated remote code execution enabling ransomware deployment	Prompt patching; vulnerability scanning; network segmentation	Encryption Advisory Services
Stolen credentials: brute force or credential stuffing attack on RDP or VPN	Attacker gains authenticated access and deploys ransomware manually	MFA on all remote access; PKI-based device authentication	PKI Services
Data exfiltration: double-extortion threat	Stolen data published publicly if ransom not paid	Envelope encryption of data at rest; HSM-protected master keys	HSM-as-a-Service

Ransomware Detection and Remediation Checklist

Detection signals to monitor:

• Mass file renaming or extension changes occurring rapidly across network shares
• Sudden high disk I/O or CPU usage from unexpected processes
• Deletion of Volume Shadow Copies or backup files
• Unusual outbound network connections to unexpected external hosts
• Anti-malware or EDR alerts on process injection or encryption behavior
• Unexpected certificate issuance or alerts from certificate monitoring

Remediation steps if ransomware is detected:

• Isolate affected systems from the network immediately to prevent lateral spread; do not shut down (preserves volatile memory for forensics)
• Identify the ransomware variant from ransom notes, file extensions, and behavioral indicators
• Verify backup integrity before beginning recovery; confirm backups are clean and predate the infection
• Revoke and rotate all credentials that may have been exposed on affected systems
• If certificates or private keys were accessible on affected systems, initiate immediate revocation and key replacement
• Notify relevant internal stakeholders including legal counsel, HR, communications, and executive leadership
• Assess regulatory notification obligations (HIPAA, PCI DSS, GDPR, state breach notification laws)
• Do not pay the ransom without consulting legal counsel; document the decision-making process
• Preserve forensic evidence before remediation activities
• Patch the vulnerability used for initial access before reconnecting recovered systems
• Conduct post-incident review and update the incident response plan

How Encryption Consulting Can Help

Encryption Consulting is a consulting company dedicated to protecting your organization from outside attackers. We offer services that include certificate and key management, PKI assessment, PKI design and implementation, CertSecure Manager for automated certificate lifecycle management, HSM-as-a-Service for tamper-proof key storage, and PKI-as-a-Service. Our encryption assessments help you identify weaknesses in your cryptographic environment, while we design and implement a roadmap to address those gaps. We can also help you implement and test your Disaster Recovery Plan to ensure that ransomware attackers have no leverage against your organization.

Update Log

Date	Event / Update
July 2, 2021	Kaseya VSA supply chain ransomware attack by REvil group affects Kaseya’s MSP customers and their downstream clients
July 14, 2021	Original blog post published covering the Kaseya attack and ransomware protection best practices
2022	Notable ransomware attacks against Nvidia (February 2022) and Entrust Corporation involving stolen code signing certificates
September 2026 (this update)	Content updated with structured answer-first opening, Quick Answer H2, Kaseya case study expansion, ranked protection methods, detection and remediation checklist, ransomware decision table, update log, and FAQ section

Frequently Asked Questions

What is ransomware and why is it recommended not to pay the ransom?

Ransomware is malware that encrypts victim files and demands payment for the decryption key. Law enforcement agencies including the FBI recommend against paying because the attacker may not provide the decryption key after payment, may use stolen data for future blackmail regardless, and payment funds future ransomware operations. Organizations with tested offline backups can recover without paying.

How did the Kaseya ransomware attack work and why was certificate management the critical failure point?

On July 2, 2021, the REvil group exploited an authentication bypass in Kaseya’s VSA tool and used a stolen private key to sign the ransomware payload with a certificate from the PB03transport organization. This made the malware appear as a legitimate signed software update, which was then distributed automatically to MSP customers through the trusted update channel. With proper certificate monitoring and key inventory management, the compromised private key could have been detected and revoked before it was used.

What is envelope encryption and how does it protect against ransomware?

Envelope encryption encrypts data with a data encryption key (DEK), then encrypts that DEK with a master key (KEK) stored separately. Even if an attacker steals both the encrypted data and the DEK, they cannot decrypt the data without the master key. This removes the blackmail leverage of double-extortion ransomware attacks, because the stolen data remains unreadable without the separately stored master key.

Why should encryption keys be stored in HSMs rather than software?

Hardware Security Modules (HSMs) are tamper-proof and tamper-evident devices designed specifically for cryptographic key storage. Unlike software-based storage, an HSM prevents key extraction even by attackers with root access to the host server. HSMs also provide FIPS 140-2 Level 3 compliance, demonstrating that cryptographic key protection meets a certified security standard.

What is a Disaster Recovery Plan and why is it the most important ransomware protection control?

A Disaster Recovery Plan (DRP) for ransomware defines procedures for restoring systems to a pre-infection state without paying the ransom. It is the most important control because it removes the attacker’s primary leverage. A functional DRP includes tested offline backups, documented restoration procedures, Recovery Time Objectives and Recovery Point Objectives, and a communication plan. A plan that has never been tested is not a functional DRP.