Rethinking Ransomware Defense at the Filesystem Layer

Most ransomware post-mortems start at the wrong moment. They start with the ransom note, because that's the moment everyone noticed. But the note is the end of the story. By the time it appears, the attacker has usually had two or three…