Ryan Chapman of the SANS Institute is author of the upcoming SANS course FOR528: Ransomware for Incident Responders. Chapman advises to mentally prepare yourself that you wont get all your data back after a ransomware attack. Most organizations are more hurt by ransom attacks because they are blocked from patching quickly and from updating to supported and more secure platforms. He sees two types of blocks: internal and external patching blocks. You must overcome these blocks to keep the support at the support of the support provided by the vendor at the time.”]

