šŸ›”ļø Can we stop a ransomware attack?

Ransomware is a virus that locks a companyā€™s computers until it gets paid. This page is a safe pretend office where you can test which defenses protect it best. No real viruses involved.

How to use this page

  1. Pick your defenses on the left, or leave them all off to see the worst case.
  2. Press ā€œStart the attackā€ and watch the virus spread from computer to computer.
  3. Press ā€œTest it 200 timesā€ for reliable average numbers, or ā€œFind the best comboā€ to compare every combination.

Step 1 Ā· Pick your defenses

Like locked doors between rooms: the virus canā€™t easily jump from one department to another.
Fewer people click the bad link, so fewer computers are infected at the start (25% click ā†’ 8%).
Updated computers canā€™t be infected. Higher is better.
Average hours before a security tool spots a sick computer and disconnects it. Lower is better.
Chance per hour that a sick computer infects a connected neighbor.

Step 2 Ā· Watch it happen

Step 3 Ā· Get the numbers

How it works (in plain words)

One bad email infects a few computers. Every hour, each sick computer can pass the virus to the computers itā€™s connected to. Eventually a security tool notices, disconnects the sick computer, and IT cleans it up (4 to 72 hours). We watch for 7 days and add up the damage: $200 for every computer-hour lost, plus what the defenses cost.

For your report: agent-based model on a graph, hourly time steps, lognormal detection delay, triangular recovery time, 200 replications with 95% confidence intervals, 2ā“ factorial design.

The office network Ā· each dot is a computer

Each cluster is a department. Round dots are everyday computers; squares are important servers.

Over time Ā· red = infected, orange = disconnected, blue = fixed