Enterprise cybersecurity in Vietnam: from ransom encryption to data-theft extortion

The question most executives are asking is: we already have a firewall and antivirus, what else is missing? The short answer is: most of it. Enterprise cybersecurity in 2025 is no longer about blocking malware at the gate, because the attacker's goal has changed. They used to encrypt your data and demand a ransom — restoring from backup was the way out. Now they exfiltrate the data first, then threaten to publish it. No backup solves that.

This article describes the real threat picture in Vietnam, explains why the old defense model has expired, and lays out a layered defense architecture in the priority order a Vietnamese organization should actually follow — with a 90-day checklist for those starting from zero.

The 2025 threat picture in Vietnam

Three attack patterns dominate, and they are not mutually exclusive.

• Ransom encryption. Still here, still painful. The high-profile 2024 incidents at a securities firm and a large fuel distributor showed that the damage is not the ransom but the downtime: systems frozen for days, customers locked out of their accounts, reputational cost lasting far longer than the recovery bill.
• Data theft followed by extortion. This is the fastest-growing pattern. In September 2025, the ShinyHunters group claimed an attack on the National Credit Information Centre; authorities confirmed personal data was stolen, at a scale of roughly 160 million records. We covered the lesson separately in the risk of centralized data stores.
• Supply chain and SaaS partner compromise. On 14 October 2025, Vietnam Airlines confirmed a customer data exposure — yet its own systems were never attacked. The data left the airline's control through a third-party platform, and the actual attack chain ran through an OAuth token belonging to an integration plugged into that platform. The technical detail is in data exposure through the SaaS supply chain.

What all three share: none of them is stopped by endpoint antivirus.

Why antivirus and a firewall are no longer enough

The old model rests on one assumption: there is a clear boundary between inside and outside, and bad things arrive from outside as malicious files. That assumption has broken in three places.

• Attackers log in rather than break in. Most major incidents start with a legitimate account being taken over — a leaked password, a phishing email, or a third-party integration token. To the system, that is a normal session. There is no malicious file to scan.
• The perimeter no longer exists. Customer data sits in an external CRM, documents sit in cloud storage, staff work from home networks and cafés. A perimeter firewall now guards a small slice of the picture.
• The damage happens after entry, not at entry. The gap between initial foothold and bulk data exfiltration is usually days, sometimes weeks. If nobody looks at the logs during that window, no amount of gate defense matters.

The practical conclusion: shift investment from blocking at the edge to limiting the damage once an attacker is already inside.

A layered defense architecture for enterprise cybersecurity

The order below is sorted by return on cost for a mid-sized Vietnamese organization, not by how impressive the technology sounds.

• Layer 1 — Identity and privilege management. Start here, because nearly every major incident runs through an account. Enable multi-factor authentication on every administrative account and every remote access path. Eliminate shared accounts. Apply least privilege: no single account should be able to reach everything. Periodically review accounts belonging to departed staff and to contractors.
• Layer 2 — Network segmentation. The goal is that one infected machine does not take the whole estate with it. Separate the server network from the user network, production from test, and finance or industrial control systems from everything else. Segmentation is the cheapest measure that most reduces the blast radius.
• Layer 3 — Immutable backups and restore drills. Keep the 3-2-1 rule: three copies, on two media types, one off-site. Add one mandatory condition for the ransomware era: at least one copy must be immutable or offline, because attackers hunt down and delete backups before encrypting. More important than backing up is restoring: schedule a real restore of a real system every quarter and time it.
• Layer 4 — Web application and API protection. For most organizations, the internet-facing surface is the public portal, internal apps published outward, and APIs. A web application firewall in front of those services blocks the most common attack classes and, just as valuable, shows you what traffic is knocking. Orca WAAP is the self-hosted route for this layer when an organization does not want its traffic routed through an offshore service.
• Layer 5 — Monitoring and logging. No logs means no investigation, and no investigation means you cannot say which data was taken. At minimum: centralize authentication logs, server access logs and data export logs, retain them long enough, and alert on a handful of unambiguous signals — administrative logins outside business hours, unusual bulk data exports, a new account granted high privilege. A full SOC is the destination, but a minimal alert set that people actually watch beats an operations centre nobody staffs.
• Layer 6 — Incident response process. Write it down in advance; one page is fine. Who decides to disconnect a system, who to call and within how long, how to notify authorities and customers, who speaks publicly. Information security incident response usually fails not for lack of tooling but because, in the moment, nobody is willing to make the call.

For internal data and infrastructure, Manta Security covers device management, permissions and centralized access monitoring — layers 1 and 5 in the list above.

Who owns what

Most security plans fail here rather than in the technology.

• Executive board. Approve the accepted risk level and the budget; decide in advance whether the organization pays a ransom, so the debate does not happen mid-crisis.
• Head of technology. Owns the six layers above and reports progress in concrete numbers: percentage of accounts with multi-factor authentication enabled, measured recovery time from the last drill.
• System administrators. Daily operations: patching, backup verification, alert triage.
• Business unit heads. Confirm who may access which data. IT does not know what finance needs to see; only the finance lead does.
• Legal and HR. Personal data breach notification duties, security clauses in contractor agreements, and the access revocation process when staff leave.

A first-90-days checklist for organizations starting from zero

The first thirty days are for knowing what you have.

• Inventory systems and data: what runs, what data it handles, who owns it.
• List every administrative account, including those held by contractors and software vendors.
• Inventory what is exposed to the internet: domains, service ports, APIs.

The next thirty days are for the highest-yield fixes.

• Enable multi-factor authentication on all administrative accounts and all remote access.
• Disable dormant accounts; revoke unnecessary elevated privileges.
• Stand up an offline or immutable backup for the single most critical system, then restore it once as a test.
• Put a web application firewall in front of the most important internet-facing service.

The final thirty days are for detection and response.

• Centralize logs and switch on three to five meaningful alerts.
• Write the one-page incident response process, with real names and real phone numbers.
• Run one tabletop exercise: a vendor reports your data was exposed — what happens in the first 24 hours.
• Segment at least one important network boundary, usually servers from user workstations.

Three common mistakes

• Buying tools before defining process. An intrusion detection system whose alerts nobody reads is just an annual expense. Process first, tooling second — or at least in parallel.
• Backing up without testing restores. Plenty of organizations discover that the backup is corrupt, incomplete, or takes eighteen hours to restore on exactly the day they need it. The metric is not "we have backups" but "how long until we are running again".
• Forgetting contractor privileged accounts. The vendor who deployed a system three years ago usually still holds an admin account, usually shared, usually without multi-factor authentication, and usually absent from every list. This is the most common back door we find during reviews.

The legal frame, read as one

Two instruments shape corporate obligations in the period ahead.

• System security. Cybersecurity Law 116/2025/QH15 was passed on 10 December 2025 and takes effect on 1 July 2026. It merges the information security and cybersecurity frameworks, establishes the concept of data security for the first time, and classifies information systems into five levels — the more critical the system, the stricter the protection duties.
• Personal data security. The Personal Data Protection Law 91/2025/QH15, issued on 26 June 2025 and effective from 1 January 2026, sets protection and breach notification obligations for personal data.

Review both in one pass. Classifying systems by level is also a good moment to decide which data belongs on infrastructure you control — a topic we examine in choosing on-premise or cloud for compliance. For data already sitting with external providers, the third-party risk management checklist is the complementary step.

Conclusion

Ransomware defense today is not about buying another product. It is about accepting that an attacker will get in, and preparing so that when they do they take as little as possible, you notice as early as possible, and you recover as fast as possible. The six layers above do not have to happen at once; doing them in the right order is already most of the difference.

To review your current defenses against your organization's actual systems and data, book a consultation.