Ransomware detection is just a (perhaps necessary) band-aid.

By default all applications should be sandboxed. Why should a random application be able to read/write to every user directory? We enforce process separation in memory, we should do the same on disk.

> all applications should be sandboxed.

not a bad plan, but also, all data should be backed up. In this 'cloud age' of computing, there's no reason, and no excuse. I certainly don't want to blame the victims of ransomware, but if that data was so important that they paid ransom to get it back, why didn't they back it up ?

Except the way most people do backups, by the time they are made aware of the ransom, their backup files are already overwritten with the encrypted ones.

I would also add, multiple backups in multiple places.

Just for my Windows PC I have three backups. One on the machine, one on an external hard drive and one more in the cloud.

How much did it cost me? $80 for the 2TB hard drive and $8 a month for unlimited cloud storage and backup. A small amount to pay to make sure you're covered in nearly any disaster scenario, including ransomware.

The Mac makes this so easy with Time Machine. Is there something that's equally easy and effective in Windows?

Unfortunately, not really. Backup on Windows is strangely terrible out of the box. The best solution for Windows is probably Arq.

Why couldn't the ransomware encrypt your Time Machine drive as well?

It certainly could do this. I don't think Time Machine protects its data in any way.

Backups have to be coupled with some kind of way of noticing that something is wrong. If the ransomware encrypted your data slowly over the course of months and you didn't notice you might be out of luck regardless of your backup system.

Don't keep the drive always connected and you're fine

That's exactly what UWP(universal windows platform) is - it sandboxes every app. But I am sure you will agree that having this as default behavior on windows would be disastrous, breaking compatibility with every app written before Windows 10, not to mention that the reason why we use PCs is to have low-level access to hardware, many applications require it and sandboxing isn't going to be a good option here. I guess MacOS way of doing things is a good in-between - by default, every app not from the app store is blocked, and you have to go through a slightly cumbersome process of unblocking it manually in security settings. I'm sure it beats the default windows permission popup, which I imagine 99% of users just accept without looking at, or disable outright.

If you search online Mac forums many people ask how to disable such features.

For average joe and jane security is a nuisance.

Most of the people I know still keep it on. It also makes the user think a bit before clicking through the scary warning.

Many people just click away at every dialog that disturbs their workflow, specially if they are made to look similar to the real ones.

That is how many of these exploits work, regardless of the OS.

Not as much of a nuisance as having all of your data corrupted.

Fully agree, but sadly not as many think about it, only after getting through such a pain.

Exactly what I was thinking too.