# Demystifying Ransomware: Securing Endpoint Devices Learn best practices for endpoint devices and server security. Endpoint devices include laptops, tablets, mobile phones, Internet-of-things (IoT) and other wireless gadgets that connect to a corporate network, while servers (those boxes in the data center) provide the raw computing to run applications and store data. Both are vulnerable to ransomware attacks but can be protected by deploying very similar methods. Source: https://expedient.com/knowledgebase/blog/2021-07-06-securing-endpoint-devices-from-a-ransomware-attack/ [](#) # Demystifying Ransomware: Securing Endpoint Devices July 21, 2021 5 min Read _[This post is part of our Demystifying Ransomware series. Read the rest.](https://expedient.com/knowledgebase/blog/tag/demystifying%20ransomware/)_ The headlines just keep piling up! In the past few weeks, we’ve seen ransomware attacks continue to wreak havoc on supply chains and disrupt services. The latest round of casualties includes [JBS](https://go.expedient.com/l/12902/2021-07-21/j6xky3 "JBS"), the world’s largest processor of fresh beef and pork, [Colonial Pipeline](https://go.expedient.com/l/12902/2021-07-21/j6xky5 "Colonial Pipeline"), the U.S.’s largest refined-fuel pipeline operator, and [Ireland’s HSE](https://go.expedient.com/l/12902/2021-07-21/j6xky7 "Ireland's HSE"), which provides public health and social care services, all falling victim to ransomware attacks. At this point, few would argue that ransomware has become a “global pandemic” (as former director of the Cybersecurity and Infrastructure Security Agency [Chris Krebs puts it](https://go.expedient.com/l/12902/2021-07-21/j6xky9 "Chris Krebs puts it")), with no end in sight. Gangs of cybercriminals have even become so bold as to [advertise their services](https://go.expedient.com/l/12902/2021-07-21/j6xkyc "advertise their services") on the dark web, collaborating to share code, infrastructure, techniques, and profits. It is even being acknowledged [as a threat to national security](https://go.expedient.com/l/12902/2021-07-21/j6xkyf "as a threat to national security"). [In my first blog](https://expedient.com/knowledgebase/blog/2021-06-08-demystifying-ransomware-anatomy-of-an-attack/ "In my first blog"), I explained what a ransomware attack is and how it spreads. Now let’s talk about best practices for endpoint devices. Endpoint devices include desktops, laptops, tablets, mobile phones, and other devices that connect to a corporate network, while servers provide the raw computing to run applications and store data. Both are vulnerable to ransomware attacks, in different ways, but can be protected by deploying very similar methods. **Protecting Users from Themselves** The most common way ransomware spreads is via email or phishing scams because of the way they exploit employee/human vulnerabilities. They operate by having criminals impersonate legitimate organizations via email, text message, advertisement, or other means to fool users into opening the door. Just one bad click or download and the dominos can begin to fall. A best practice and way to safeguard against such an attack is to implement a system of email scanning and advanced firewall protection capabilities to prevent malware from even knocking on your door. ![](https://res.cloudinary.com/dvlpy3tua/image/upload/fl_sanitize/uploads/exp__ransomware_blog-visual_v2-03-03.png) Email filters help detect and block unwanted emails from ever reaching employees. They work by reading emails, opening attachments, and tracking every link to analyze the data for malicious content. It blocks dangerous files and malicious links from reaching employees, preventing the opportunity for an employee to make a mistake. In addition to email scanning, a firewall that uses website reputation intelligence helps protect employees from accessing malware sources and malicious or inappropriate content on the Internet, typically via a web or URL filtering solution. As an example, if you’ve ever tried to access a web page at work and gotten a “website blocked” notification, your company is using web filtering. This way, administrators and security teams can block a variety of content on the way in and prevent access to malicious content. **Looking for “Bad” Behavior** Being able to detect and notify bad user behavior is critical to any ransomware defense. There are three key areas of focus for this: behavioral detection, access control, and micro-segmentation. This is where Expedient can help with a modern behavioral-based detection and response solution. If ransomware can’t get its foot in the door, it can’t take hold of your business. Additionally, properly controlling access to applications through a robust identity and access management policy and solution further reduces the chances of an initial infection. Finally, a robust micro-segmentation strategy can make it much more difficult for an attack to spread, should it find a way in the door. All three of these areas of focus share a common goal – explicitly grant access to known good entities (i.e., code execution, network paths, or access policies) and block everything else by default. We’ll talk more about network protection in a later post. **Preventing Malicious Code from Executing** The next step is a firewall to scan all incoming traffic and keep malicious code from entering the network using [automated sandbox analysis](https://go.expedient.com/l/12902/2021-07-21/j6xkyh "automated sandbox analysis"). If the malicious code is able to sneak past that scan, [endpoint security](https://go.expedient.com/l/12902/2021-07-21/j6xkyk "endpoint security") can prevent the code from running and potentially spreading. By explicitly allowing only known good code to run and preventing it from being used maliciously, you can prevent many ransomware attacks from starting or spreading. ![](https://res.cloudinary.com/dvlpy3tua/image/upload/fl_sanitize/uploads/exp__ransomware_blog-visual_v2-01.jpg) **Go Beyond the Tools** While utilizing best-in-class technology can help prevent attacks, your people and processes also need to be tuned to prevent ransomware attacks from spreading. One common way to do this is to utilize the Principle of Least Privilege for granting access to systems. By keeping access needed to the absolute minimum, you can prevent user accounts from being compromised and used to slip past defenses. This is especially common in spearphishing attacks that target IT administrators to use their accounts to access and exfiltrate personally identifiable information. Additionally, all access and activity should be logged to monitor for anomalous activity. **A Multi-Layered Approach** The big takeaway from all this is that protection from a ransomware attack needs to be layered like an onion. You need protection and security at every level—endpoint devices, network, servers, and data backup. Hopefully, this has given you some insights into how to defend the periphery and endpoints of your network. In my next blog post, I’ll take a deeper look at how to protect your servers and network from a ransomware attack. In the meantime, let me know if you have any questions: experts@expedient.com. [Let’s Talk](https://expedient.com/lets-talk/) #### #### #### #### [ ![Anthony Jackman](https://res.cloudinary.com/dvlpy3tua/image/upload/fl_sanitize/uploads/jackman-anthony.jpg) Anthony JackmanChief Innovation Officer ](/knowledgebase/blog/authors/anthony-jackman) [Demystifying Ransomware](/knowledgebase/blog/tag/demystifying%20ransomware)[Disaster Recovery](/knowledgebase/blog/tag/disaster%20recovery) ### Related Posts [ #### The VMware Wait Tax: Why Every Quarter of Delay... Inaction on a VMware migration is widely treated as a neutral position, a de... Learn More ](/knowledgebase/blog/2026-08-04-the-vmware-wait-tax-why-every-quarter-of-delay-has-a-price-tag/)[ #### The Great Inversion What was easy is now hard. What was hard is now easy. {% include blog-key-... Learn More ](/knowledgebase/blog/2026-07-29-the-great-inversion/)[ #### Your New Cloud Strategy: Rebalancing for Cost a... {% include blog-key-takeaways.html items=page.key\_takeaways %} A few years a... Learn More ](/knowledgebase/blog/2026-07-15-your-new-cloud-strategy-rebalancing-for-cost-and-performance/) ## Subscribe to Our Blog VMware September 29th, 2026 at 1:00 PM ET ## It’s Time to Decide Your VMware Path [Join us →](https://go.expedient.com/VMWarePath) ### VMware September 29th, 2026 at 1:00 PM ET ## It’s Time to Decide Your VMware Path [Join us →](https://go.expedient.com/VMWarePath)