Intercepting Ransomware Attacks with Staged Event-Driven Access Control