Recommended Free Tools
Protecting an organization from data theft and extortion takes two kinds of preparation: controls that make unauthorized access and data theft harder, and a practiced response that limits harm if an attacker gets in. Backups support recovery, but they do not stop someone from stealing information.
What data theft and extortion can look like
Extortion does not always involve encrypted files. An attacker may steal sensitive information and threaten to publish or sell it. Encryption can accompany the theft, creating what is commonly called double extortion, but it is not a prerequisite.
As an Amazon Associate I earn from qualifying purchases.
CISA’s joint #StopRansomware Guide, developed with the Multi-State Information Sharing and Analysis Center (MS-ISAC), the National Security Agency (NSA), and the FBI, describes the distinction directly: “In some cases, malicious actors may exfiltrate data and threaten to release it as their sole form of extortion without employing ransomware.” The guide’s resource page records a revision date of October 19, 2023.
This distinction matters operationally: restoring encrypted systems may not address stolen data, the threat of disclosure, or any resulting notification duties. Plan for a data-breach response as well as a system-recovery response.
#1 Best Overall
Prepare people and decisions before an incident
Write an incident-response and communications plan
Maintain an approved incident-response plan that covers ransomware, data theft, and extortion. Make it usable under pressure: specify who can declare an incident, who leads technical containment, who makes business decisions, and who handles internal and external communications. List escalation paths and keep contact details available outside the systems that might be compromised.
Include procedures for assessing affected systems and data, coordinating notifications, and reporting the incident to relevant authorities. Notification duties depend on jurisdiction, sector, contracts, and the information involved; have qualified counsel help determine the applicable requirements and deadlines rather than relying on a generic checklist.
Exercise the plan with relevant stakeholders
Run exercises before an incident. Include the people who would make or carry out decisions—such as IT and security staff, leadership, communications, legal counsel, and relevant service providers. Test how the organization would coordinate if normal email, identity systems, or shared documents were unavailable. Record gaps, assign owners, and update the plan and contact list.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reduce the routes attackers can use
Find and fix exposed weaknesses
Use vulnerability scanning and timely remediation, with particular attention to internet-facing devices and services. Review configurations as well as software flaws: a technically patched system can still be exposed through an unsafe setting or unnecessary service. CISA’s guide recommends addressing vulnerabilities and misconfigurations and disabling applications and protocols that are not needed on internet-facing assets.
Limit internet exposure and remote access
Remove services from the public internet when they are not required. Avoid exposing remote desktop services unless appropriate compensating controls are in place. Inventory what is reachable from outside, confirm each exposure has an owner and business need, and review it when systems or vendors change.
Restrict access to what each role needs
Apply appropriately granular access controls so users and service accounts do not have more permissions than their work requires. Review privileged access and remove accounts or rights that are no longer needed. Zero-trust concepts—verifying access explicitly and limiting trust based on network location alone—can reduce risk, but no access model guarantees that an attacker cannot enter or steal data.
Rank #4
Make backups useful when production systems are compromised
Design backups so an attacker who compromises ordinary production accounts or systems cannot simply reach and destroy every recovery copy. Keep copies offline or otherwise isolated from production, encrypt them, and protect backup administration with separate, tightly controlled access. CISA warns that ransomware variants may seek out accessible backups and delete or encrypt them.
Test restoration regularly, including whether the organization can recover the systems and data it actually needs within its operational requirements. A backup that has never been restored is an unverified recovery option. Document the restore process and ensure the staff responsible can access it when production services are unavailable.
Best Value
Cloud backups and immutable storage can be part of a recovery design, but configuration and suitability matter. CISA notes that immutable-storage settings can create cost or compliance issues; assess those trade-offs against recovery needs and applicable obligations rather than assuming a feature is automatically appropriate. See CISA’s fact sheet on protecting sensitive and personal information from ransomware-caused data breaches for related backup guidance.
A small organization might use an external hard drive as one offline backup copy. It should be encrypted, disconnected and physically protected when not in use, and tested through actual restoration. A drive is one implementation option, not protection against data exfiltration or a substitute for a recovery design suited to the organization.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when you suspect an incident
Use the organization’s approved incident-response plan and coordinate with the designated incident lead. Do not improvise destructive actions that could erase evidence or make recovery harder.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- Identify affected systems and isolate them. Determine which devices, accounts, and network segments appear involved. Disconnect affected systems from the network as appropriate. If multiple systems or subnets appear affected, broader network isolation may be necessary to limit spread.
- Preserve evidence. Preserve relevant logs and, when appropriate, system images and memory captures. Volatile information can disappear when systems are shut down or altered, so follow the response plan and involve qualified responders where needed.
- Coordinate communications and reporting. Notify the internal stakeholders identified in the plan, use approved communications channels, and follow applicable notification requirements. In the United States, organizations can consider contacting CISA or law enforcement. Organizations elsewhere should use their national cyber-response authority and follow local law.
- Contain compromised access. Address affected accounts, credentials, systems, and other access paths that could let an attacker continue operating. Coordinate changes with responders so containment does not unintentionally destroy evidence or interrupt needed recovery work.
- Restore and learn. Recover from clean backups using the tested restoration process. After service is restored, document what happened, identify control or planning gaps, and update the response plan and safeguards.
The joint CISA guide provides further preparation, prevention, mitigation, response, and recovery guidance: CISA #StopRansomware Guide.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
