Rethinking Ransomware Defense at the Filesystem Layer
Most ransomware post-mortems start at the wrong moment. They start with the ransom note, because that's the moment everyone noticed. But the note is the end of the story. By the time it appears, the attacker has usually had two or three weeks of quiet, unsupervised access to your filesystem — enough time to map your data, find your backups, and start degrading them before ever triggering an alarm.
That gap between "attacker gets in" and "attacker detonates" is where nearly every ransomware defense either works or quietly fails. And it's a gap that's much easier to close at the filesystem layer than at the backup-schedule layer.
Two ideas are worth separating out, because they solve different halves of the problem:
- An access record — knowing, at the kernel level, who touched which file and when, so anomalous behavior is visible in real time instead of reconstructed after the fact.
- ...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
