Threat management and protecting against ransomware attacks

Robb Dilallo, Technology Solutions Professional, Enterprise Mobility + Security

Ransomware attacks are on the rise. A recent post on the Microsoft Malware Protection Center blog details new attacks that occurred during the holidays at the end of 2016. Ransomware prevents you from using your PC and holds your PC or files for "ransom." When this form of attack occurs, it makes it abundantly clear that a company must rethink its approach to planning, deployment, and implementation of endpoint protection.

Companies can prevent these attacks by moving to a preparation-based strategy. Executives - CIOs, CISOs, IT Directors - should use the business impact of ransomware attacks to create awareness of the need for resources that improve their operations in all stages of ever-changing security architectures.

In this post, I'll cover the Microsoft services that protect against ransomware threats, and share the resources you can use to educate users about identifying ransomware, as well as best practices for proper cybersecurity.

What is ransomware?

While there are different types of ransomware, all of them will prevent you from using your PC normally and will ask you to do something before you can get access to your PC. Ransomware attacks can target any PC user, whether on a home computer, endpoints in an enterprise network, or servers used by a government agency or healthcare provider.

Ransomware can disable critical business systems and make your files unavailable. You'll receive a demand that you pay money (a ransom) to get access to your PC or files. There is no guarantee that paying the fine or doing what the ransomware tells you to do will restore access to your PC or files. Once files are encrypted, they are virtually impossible to recover.

Throughout 2015, the average number of ransomware infections fluctuated between 23,000 and 35,000 per month, according to this Symantec report. The spike to 56,000 infections in March 2016 coincided with the arrival of the new ransomware Locky, distributed primarily by the Necurs botnet, which is one of the largest networks of infected computers in the world.

Evolution of ransomware attacks

Microsoft threat management

Microsoft threat management includes protection from both malicious software and attacks against systems and networks. Microsoft products and services, including Microsoft Azure, Office 365, Enterprise Mobility + Security, and Windows 10 have built-in protection features. These security technologies and practices apply best-in-class machine and human analysis to detect advanced threats when a user is under attack (known exploits, zero days, suspicious actors), detect compromised systems (malware and persistent implants, other indicators of compromise, new threats) and responses when a user is vulnerable. Out of date applications and systems, unpatched systems and applications, and unauthorized apps introduce high risk.

Learn more about threat management on the Microsoft Trust Center

Microsoft Azure

Microsoft Operations Management Suite

Microsoft Operations Management Suite provides a comprehensive view into your organization's IT security posture with built-in search queries for notable issues that require your attention. The Security and Audit dashboard is the home screen for everything related to security in OMS. It provides high-level insight into the security state of your computers and can detect outgoing network traffic leaving your network for a malicious location. Additionally, the Wire Data solution will help you analyze by protocol, volume, and IP address the data being moved off your network.

Learn more about Microsoft Operations Management Suite

Azure Backup

Azure Backup is a simple and cost-effective back-up-as-a-service solution that extends tried-and-trusted tools on-premises with rich and powerful tools in the cloud. This can help a customer recover data that has been encrypted by ransomware.

Learn more about Azure Backup

Microsoft Office 365

Advanced Threat Protection

Provides robust protection against “Zero-Day” attachments and real-time protection of users against harmful links.

Learn more about Advanced Threat Protection

Advanced Security Management

With Advanced Security Management, you get alerts that you can set up by using policies to notify you about anomalous and suspicious activity. And you can also get Productivity App discovery, which lets you use the information from your organization's log files to understand and act on your users' app usage in Office 365 and other cloud apps.

Learn more about Advanced Security Management

Windows 10

Microsoft Edge web browser

Keeping browsers and other software up-to-date can counter the impact of exploit kits. Microsoft Edge is a secure browser that gets updated automatically by default. It also has multiple built-in defenses against exploit kits that attempt to download and install malware. These defenses include on-by-default sandboxing and state of the art exploit mitigation technologies. Additionally, Microsoft SmartScreen, which is used in both Microsoft Edge and Internet Explorer 11, blocks malicious pages such as landing pages used by exploit kits.

Learn more about Microsoft Edge Learn more about Microsoft SmartScreen

Windows Defender

Windows Defender uses IExtensionValidation (IEV) in Microsoft Internet Explorer 11 to detect exploits used by exploit kits. Windows Defender can also detect the malware that exploit kits attempt to download and execute.

Learn more about Windows Defender

Device Guard

Windows 10 Enterprise includes Device Guard, which can lock down devices and provide kernel-level virtualization based security.

Learn more about Device Guard Device Guard deployment guide Application whitelisting in Device Guard

Windows Defender Advanced Threat Protection

Windows Defender Advanced Threat Protection alerts security operation teams about suspicious activities, including exploitation of vulnerabilities and the presence of malware, allowing them to detect, investigate, and respond to attacks.

Learn more about Windows Defender Advanced Threat Protection


When combined, the technologies and practices built into Microsoft products provide comprehensive protection from ransomware attacks. But one of the best ways to protect against ransomware is to educate users about these threats and how to prevent them.

Microsoft resources

Additional resources

Enterprise Mobility + Security Partner Community