What is cybersecurity, and what is ransomware?
Short answer
Cybersecurity is the practice of protecting computers, networks and data from unauthorised access or damage. Ransomware is malicious software that locks or encrypts files and demands payment to restore them.
The basics
Security is often described by three goals: confidentiality (only authorised people can see data), integrity (data is not altered improperly) and availability (systems work when needed). Typical threats include phishing, which tricks people into revealing passwords, malware, stolen credentials, unpatched software and misconfigured systems.
How ransomware works
Attackers first gain access, commonly through phishing emails, stolen passwords or unpatched internet-facing systems. They then spread inside the network and encrypt files so the owner cannot use them, and demand payment, usually in cryptocurrency, for a decryption key. Many groups also steal data first and threaten to publish it, called double extortion, so restoring from backup alone does not remove the pressure.
Common defences
Widely recommended steps include keeping offline, tested backups; applying security updates promptly; using multi-factor authentication; limiting each account to the access it needs; training staff to spot phishing; and rehearsing an incident response plan. Government guidance, for example from the US Cybersecurity and Infrastructure Security Agency (CISA), generally advises against paying ransoms because payment does not guarantee recovery and can encourage more attacks, and recommends reporting incidents to the authorities.
Why it appears in finance news
Cyber incidents can disrupt operations, lead to regulatory disclosure and affect the companies involved. Stories often also cover the security software and services industry.