Ransomware protection: tips and strategies

Ransomware protection: tips and strategies

Cybercriminals have refined ransomware into a money-making machine. Yet falling victim is not inevitable. Businesses that get the fundamentals right lose less data, recover faster and don't pay ransoms. That takes an approach that ties technology, processes and behaviour together.

What makes ransomware so effective?

Ransomware is no longer the work of a lone-wolf hacker; it is an entire ecosystem. Some attackers only sell access, others rent out encryption software, and others again handle negotiations and leak data. That division of labour lowers the barrier to entry for attackers and increases the scale.

Double and even triple extortion ramps up the pressure: first encryption, then data theft, and later threats aimed at your customers or suppliers. Even with backups, you are left with reputational and legal damage if personal data or intellectual property has been stolen.

One more thing: many attacks don't start with a zero-day, but with misconfigurations, unprotected RDP, stolen login credentials or poor segmentation. That's good news, because this is where you can make immediate gains.

Build defensive layers that catch mistakes

Defence is built in layers. Not one concrete wall, but several safety nets that compensate when a previous layer fails. Start with the principle of least privilege: accounts and systems get only what they genuinely need. Combine that with network segmentation, so a break-in on one laptop doesn't immediately compromise the entire domain.

Zero trust isn't a product here, it's a design choice. Think per-session verification, context-aware access and strict separation between office IT and production OT. Admin access is granted temporarily, logged and kept apart from regular accounts. Just-in-time privileges limit the damage if they are misused.

Work on configuration standards too. Harden images, close ports you don't need and block unnecessary scripting. Application control with allowlisting makes lateral movement and the execution of unknown binaries difficult.

No single layer is perfect.

Backups that actually work when things go wrong

The 3-2-1-1-0 rule remains rock solid: three copies, on two different media, one offsite, one immutable or offline, and zero errors in restore tests. Immutability stops an attacker from turning your backup software into a destruction machine. Air-gapped solutions and object storage with write-once-read-many make sabotage harder.

Treat your backup environment as a crown jewel. Separate accounts, stricter MFA, separate networks and a separate directory. Don't run backup services with domain admin rights. And give the backup administrator role to a different team from the one that manages production, so a single compromised identity can't reach everything.

Recovery is a skill. Every month, test restoring a representative set of systems, including a domain controller, a critical database and a SaaS workload. Measure RTO and RPO, and record who makes the calls on prioritisation. Without rehearsed runbooks, a restore turns into chaos.

Prevention at the front door

Most attacks start with email, identities or exposed services. So raise the fences at the front door. Start with DNS and web filtering, strict rules for attachments and sandboxing of unknown files. Block macros from internet sources by default and enforce Protected View in Office.

Email authentication deserves attention. DMARC with p=reject, enforced SPF and DKIM, and monitoring for lookalike domains all limit spoofing. Combine this with reputation-based filtering and CDR solutions that neutralise active content.

Keep software patched promptly, prioritising internet-facing services and widely used frameworks. Unrestricted RDP exposed to the internet belongs in the past. If remote administration is genuinely needed, do it through a broker with MFA and logging. Require MFA on every account that comes anywhere near admin rights.

• Network segmentation
• Fast patch cycles for internet-facing services
• Application allowlisting
• Controlled macro settings
• DNS and web filtering
• MFA on everything: enforce phishing-resistant methods for administrators and external users.
• Email authentication: set DMARC, SPF and DKIM to strict and monitor for spoofing.
• Controlled access: remove direct RDP and use a broker with logging.
• Script control: block unknown PowerShell and WSH scripts by default.
• Credential hygiene: no reuse of local admin passwords; use LAPS or PAM.

Fast detection

Prevention alone won't save you. Modern EDR or XDR tools detect behaviour that points to ransomware: mass file writes, strange extensions, calls to delete shadow copies and unexpected access to backups. Set up policies so endpoints are isolated automatically when the signals are strong.

Use canary files and tokens on file shares and critical servers. As soon as someone opens or modifies one, an alarm goes off. Combine endpoint telemetry with network visibility, such as NetFlow, DNS logs and proxy data. That way you can spot lateral movement and exfiltration over unusual protocols.

Make sure logs are stored centrally for at least 30 to 90 days, with their integrity safeguarded. Automate the first response: block the user, isolate the device, revoke tokens, preserve snapshots. Time is your best friend here.

People and process

Employees remain a target because people collaborate and trust each other. Set up training that matches each role and its risk, not just an annual e-learning module. Let teams practise with realistic phishing simulations and give them a simple report button. Reward reporting; don't punish it.

Incident response requires predefined roles, playbooks and contacts. Who decides to take a connection offline? Which systems get priority during recovery? Which lawyer calls the regulator in the event of a data breach? Rehearse this with tabletop sessions and identify where the friction is.

Think about preserving evidence and legal steps. Make arrangements with a forensic partner in advance and check the terms of your cyber insurance. Document how you will decline negotiations and how you will communicate with customers if data has been stolen.

Suppliers, SaaS and the downside of convenience

Wherever your data lives, security has to be there too. SaaS is no free pass. Control access through SSO, restrict OAuth apps and invalidate tokens during offboarding. Set up alert rules for mass exports, approval of third-party apps and unusual login locations.

Limit third-party admin accounts and log everything they do. Use just-in-time access and let permissions expire automatically. Contractually, set requirements for vulnerability management, incident reporting and pentest summaries. Supply chain attacks often hit exactly where trust is highest.

A practical 90-day plan

Days 1 to 30: fix the basics. Enable MFA for administrators and external partners, close unused RDP ports and clear your patch backlog. Roll out hardening baselines for Windows and Linux. Start DMARC, SPF and DKIM in monitoring mode and move to reject once alignment is correct. Define log retention and activate EDR on every endpoint.

Days 31 to 60: expand detection and backups. Implement immutability and an offline copy. Test restoring three critical systems and record RTO/RPO. Add canary files to file shares. Set up automatic EDR actions for mass-encryption patterns so ransomware attacks are detected and stopped quickly. Restrict admin rights with a temporary approval process and log every elevated session.

Days 61 to 90: close the culture and process gap. Run a tabletop exercise with IT, legal and communications. Write concise runbooks for isolating endpoints, external communication and recovery prioritisation. Review supplier permissions and revoke outdated API tokens. Establish a quarterly rhythm for patching, restore tests and reporting to management.

Common misconceptions that cost organisations dearly

Ransomware only targets large companies. On the contrary: SMEs with weak backups and exposed RDP are a lucrative target.

MFA is enough. Attackers abuse OAuth consent, token replay and push spam. Choose phishing-resistant methods, restrict consent and set up device trust.

Backups are always safe. Without immutability, separation of duties and network segmentation, backups are often encrypted right along with everything else.

EDR solves it. Without response automation and clear responsibilities, alerts go unanswered. Detection without action is a siren without a fire brigade.

What gets measured gets managed

Security you don't measure slips. Define a short set of KPIs and make them visible to both IT and leadership. Think of patch lead time for internet-facing services, the percentage of endpoints with EDR active, the number of successful restore tests per month, MFA coverage and the number of high-risk email domains with DMARC set to reject. Fewer numbers, but the right ones.

Build those KPIs into regular portfolio management. Tie budget to reducing risk in specific business processes. That shifts the conversation from products to outcomes.

Technology choices you won't regret

Choose solutions that suit your scale and your team. A lean EDR with good automation and integration with your ticketing system can be worth more than an overloaded platform nobody manages. For backup, look for recovery reliability, not marketing features. And avoid lock-in by storing backups in open formats and testing exit scenarios in advance.

Work from reference architectures by recognised sources and translate them to your environment. A small, well-configured set of controls works better than a full toolbox that is only half switched on.

Security that doesn't get in the way of work

Security should enable the business. Involve operations early, test policies with a subset of users and communicate changes clearly. Use change windows that suit the business. Where rules are strict, support needs to be fast. That builds buy-in and reduces the temptation to look for workarounds.

Smart defaults prevent friction: SSO with MFA based on app risk, pre-approved application sets and self-service requests for temporary access with an automatic expiry date. When the secure path is also the fastest path, it stays secure.

What to do during an active attack

Secure your logs, isolate suspicious endpoints and revoke tokens to minimise the impact of the ransomware. If necessary, temporarily set file shares to read-only. Bring in your forensic partner and preserve memory and disk images of key systems. Communicate factually and frequently with staff and the board, without speculation. Report data breaches promptly and accurately, focusing on impact and recovery steps.

Recover in phases. Start with identity and domain control, then core applications, then data services and clients. Don't restore blindly: apply hardened images and reset secrets. Once production is running again, schedule a post-incident review with concrete improvement actions and deadlines.

With a focus on layers, human behaviour and recovery skills, ransomware turns from an existential threat into a manageable business risk. It takes discipline, but it buys you peace of mind.