What happens in a ransomware attack
The 16-page presentation describes a chain from phishing or insider compromise to network discovery, sensitive-data extraction and ransomware deployment. Paying can lead to further demands and does not guarantee recovery; survey percentages shown are historical research references, not a prediction of any individual incident.
Five organisational measures
Train employees in security habits and recognising malicious messages. Enable multi-factor authentication. Improve visibility into new or abnormal activity, including insider risks. Use suitable controls to stop damaging ransomware activity. Prepare an end-to-end process from detection through response and recovery.
The domain-recognition quiz contrasts the genuine-looking bank domain with lookalike strings using extra words, misspellings or a zero in place of a letter. Independently verify a bank address rather than trusting a displayed link or logo.
Solutions, grants and legal context
The source includes a commercial integrated security-service example and temporary PSG funding of up to 80% through 31 December 2020. These are historical presentation details, not a current offer or recommendation. Its PDPA penalty slide simplifies legal context; actual notification duties and penalties depend on current law, applicability and the facts of a breach.