Does encryption prevent ransomware?

Ransomware attacks have climbed for years, and there are a lot of questions about how to prevent them. Let's answer a common one: does encryption prevent ransomware?

Even if you've encrypted your hard drives, ransomware can still encrypt (re-encrypt) them. Encrypting your own drives doesn't prevent ransomware — it only protects the contents from being read. An attacker still can't read the files, but they can still make them unusable.

How ransomware works

Ransomware is malware that blocks access to your files or systems and demands payment for a decryption key. Attacks usually begin on one device and spread to others; the attacker is typically in your network well before you see the ransom message.

The most common entry point is phishing — an email with a malicious attachment or a link to a drive-by download. As email filtering has improved, attackers have also turned to stolen credentials for RDP and VPNs to get in.

Ransomware and already-encrypted drives

You may already use BitLocker to encrypt your drives — but that doesn't stop ransomware from encrypting the files again. When you boot an encrypted disk and log in, the decryption key sits in memory so files can be accessed. Any application you run can reach those files — and so can ransomware.

Drive encryption prevents unauthorized parties from reading data off a drive while it's off. It won't prevent ransomware. Just like ordinary software can run on an encrypted drive, so can ransomware. Preventing ransomware requires layered security controls.

Ways to reduce ransomware risk

There's no silver bullet, but combining controls goes a long way:

Network segmentation

Segmentation is one of the best ways to stop ransomware from spreading. On a flat network, ransomware can move rapidly and take everything down; segmentation slows or contains it.

Multi-factor authentication (MFA)

Requiring MFA on administrative accounts — and before remote sessions or logins to critical systems — makes stolen credentials far less useful to an attacker.

Patching and updates

Keeping systems patched prevents the majority of ransomware. WannaCry (2017) is the classic example: Microsoft had released a patch two months before the outbreak — even for unsupported systems.

Conclusion

Encryption won't prevent ransomware; it just ensures attackers can't read your data even as they lock it from you. The only real way to prevent ransomware is a layered approach to security.