Comment by cmckn

I’m ignorant as to how these attacks are so successful. Seems like they always start with a phishing email, but how does some malware on one employee’s computer end up encrypting the “source of truth” for the entire company? Sure, some employees have a lot of access, so obtaining the right person’s credentials will get you a lot of the way there; but it seems like categorically preventing this type of attack should be possible with the right internal security approach. Even just the amount of time it takes to encrypt the data confuses me about this. Do the attackers just choose to launch this on a long weekend?