The primary ways threat actors gain access to and steal, or exfiltrate, data for ransom profit are: Exploiting unpatched systems, particularly legacy software products such as older versions of backup infrastructure, files shares, databases, operating systems and browsers Compromised user credentials, which can happen when someone inadvertently provides their log-in to someone else, someone from outside of the organizations hacks into a system or an authorized employee with malicious intent exploits admin privileges To counter the last scenario, also known as the insider threat, organizations can use mechanisms such as write once, read many (WORM) technology. It enables the creation and application of a time-bound lock on data through policies and then the assignment of them to selected jobs to enhance immutability for protected data. With it in place, either security officers nor security admins can modify or delete the policies, thwarting potential attacks by employees from inside.