Ransomware is proving to be a major challenge for computer users all over, including Microsoft when it comes to handling malware on Windows 11/10. In fact, the company claims that the variants of ransomware have more than doubled in the past 12 months. And while other kinds of viruses and trojans are short-term and extractable, Ransomware works on the premise of extorting funds in return for non-deletion of all your important files and documents. To add to that, methods and means attackers are using to perpetrate ransomware attacks are varied, complex and costly. Here is how Windows 11/10 deals with the threat of ransomware on your PC.
Ransomware protection in Windows 11/10
Windows has added new technology to increase protection against malware, including ransomware-related threats. Microsoft has made it so that it is extremely difficult for certain exploits to work when using Microsoft Edge, and enhanced URL reputation to better notify you about potentially unsafe websites. We increased the ability to block email attacks from ever reaching our consumer and commercial productivity suite customers. Microsoft has released Windows Defender ATP to make it easier for companies to investigate and respond to ransomware attacks, and more!
Read: How to enable and configure Ransomware Protection in Windows Defender.
RANSOMWARE PROTECTION IN WINDOWS 11/10
For protection against ransomware attackers, Windows 11/10 offers significant improvements for your computer. So you need to do the following things first to stay protected:
- Update to the latest Windows 11/10 version and switch to default settings.
- Keep your operating system and installed software updated with the latest versions.
- Manage your backup and restore strategy well.
Apply these protection measures in Windows 11/10 to make your network security stronger, says Microsoft:
- Randomize local administrator passwords using a tool such as LAPS.
- Apply Account Lockout Policy.
- Ensure good perimeter security by patching exposed systems.
Apply mitigating factors, such as MFA or vendor-supplied mitigation guidance, for vulnerabilities. - Utilize host firewalls to limit lateral movement.
- Prevent endpoints from communicating on TCP port 445 for SMB. This will have limited negative impact on most networks, but can significantly disrupt adversary activities.
- Turn on cloud-delivered protection for Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques.
- Turn on Tamper protection features to prevent attackers from stopping security services.
- Turn on attack surface reduction rules, including rules that can block ransomware activity:
- Use advanced protection against ransomware
- Block process creations originating from PsExec and WMI commands
- Block credential stealing from the Windows local security authority subsystem (lsass.exe)
Related reads:
- How to enable and use Controlled Folder Access
- How to allow Apps through Controlled Folder Access
- How to configure Controlled Folder Access using Group Policy & PowerShell
- Add Controlled Folder Access commands to Context Menu.
RANSOMWARE PREVENTION
- Browser Hardening
As seen last month, some malware attackers were using software like Adobe Flash to gain access to browsers and harm computers. With the new update, Microsoft has updated Adobe Flash to run in an isolated container within the Microsoft Edge browser. The update also introduces a feature on Edge that prevents malware from leaving the browser and affecting other programs. This border tightening on Microsoft Edge will help contain the ransomware and speed up the removal process. These improvements also block malware from silently downloading and executing additional payloads on customers’ systems.
- Improved SmartScreen
In order to do a better job of preventing browser-based ransomware from reaching users in the first place, Microsoft extended SmartScreen Filter by cultivating a broad set of data from sources that are part of the Microsoft Intelligent Security Graph. When you unwittingly click on a link that could lead to an unsafe website, Windows can notify you that the site could be malicious.
- Email Protection
Another major distribution channel for ransomware attackers is via email attachments. They can send across malicious links via emails, which vulnerable users then click. Microsoft claims to have advanced the machine learning models and heuristics to catch malware distributed in the email and developed a faster signature delivery channel to update Windows Defender faster on email. The result will be improved protection levels for both consumer and commercial customers. Take a look at the precautions to take when opening email attachments or before clicking on web links.
- Machine Learning
Apart from protecting all the loose ends on their browser and email servers, Microsoft has also introduced a better and more efficient Machine Learning that will pave the way for the tougher implementation of ransomware defense. The improved machine learning techniques can detect malware quickly. The entire process of detecting, analyzing, and then trying to remove malware becomes a task that is completed in minutes.
Read: Protect against and prevent Ransomware attacks.
RANSOMWARE DETECTION
- Windows Defender
Windows Defender has been Windows’ default security software, which saw the light of day during the XP times. The software has become more robust and reliable. The update can now respond to new threats faster, utilizing improved cloud protection and automatic sample submission features to block malware as soon as it is spotted. Windows Defender’s behavioral heuristics have been improved to help determine if a file is performing ransomware-related activities, and then detect and take action more quickly. It also helps defend against Ransomware infections in Corporate Networks.
Read: Ransomware Attacks and Protection.
ACTION TO BE TAKEN
Once the ransomware has been detected with the help of Windows Defender, it is time to tackle the attack. Windows brings with it the new Windows Defender Advanced Threat Protection service which adds the ability for companies to detect and prevent attacks that have made it through the other protection methods. Windows Defender ATP combines security events collected from the machines with cloud analytics to detect signs of attacks and help your PC stay away.
Apart from this, Microsoft is also initiating a new feature – ‘Block at First Sight‘ – which is a cloud protection service that has been turned on by default.
This is how Windows 11/10 helps keep you protected against Ransomware, thanks to the new features it introduces.
While cyber-attacks are never completely avoidable, Microsoft is pursuing a future to minimize the impact of such attacks and keep Windows protected at all times.
How do I remove ransomware from Windows 11?
The only way to remove ransomware from Windows 11 is by using a protection shield. There are so many ransomware removal tools available for this OS. However, you need to recognize the ransomware first, and then you can install the respective tool to remove it. That being said, to protect your computer from ransomware, it is recommended to use Windows Security or another protection tool first.
Should I turn on Windows ransomware protection?
Yes, it is highly recommended to turn on Windows ransomware protection. No matter which security app you are using, nowadays, most of the apps come with such option. Whether it is Windows Security or any other tool, you must enable ransomware protection on your Windows 11/10 PC in order to protect your files.
Now read: What to do after a Ransomware attack on your Windows computer?
