How to Protect Your Business from Ransomware

The mental image most people hold of ransomware is a moment: screens lock, a ransom note appears, work stops.

That moment is real, but it is the end of the story rather than the beginning. By the time anything is encrypted, an attacker has usually been inside the environment for days or weeks — looking around, escalating access, finding the backups, and quite often copying data out.

Understanding that sequence matters, because it changes where defenses do the most good.

How the attack actually unfolds

Getting in. Usually through one of a small number of routes: a phishing email that harvests credentials or delivers a payload; an exposed remote access service with weak or reused credentials; an unpatched internet-facing system; or a compromised supplier with access to your environment.

Staying quietly. Establishing persistent access that survives a reboot, and blending in with ordinary activity.

Escalating. Moving from an ordinary user account toward administrative rights — often through credentials cached on a machine, or an account with more privilege than its owner needed.

Reconnaissance. Mapping what exists: file servers, databases, the systems the business cannot operate without — and, specifically, the backups.

Exfiltration. Copying data out. This step is now standard, and it is why paying to decrypt does not resolve the situation. The second demand is about publication.

Neutralising recovery. Deleting or encrypting backups, shadow copies and snapshots. This is deliberate and it comes before encryption.

Encryption. The visible part, usually timed for a weekend or holiday when response will be slowest.

Why backups alone are not protection

Backups are essential. They are also, on their own, an incomplete answer — and it is worth being direct about why, because they are frequently marketed as ransomware protection.

Backups do not prevent the intrusion. They do not undo data that was copied out before encryption; restoring your systems does nothing about a threat to publish client records. And backups reachable with the same credentials, on the same network, as everything else are frequently destroyed during the attack — because attackers look for them first.

What good backups genuinely provide is a way back that does not depend on an attacker keeping their word, and far less pressure to pay. That is valuable. It is recovery, not prevention.

Reducing the chance of getting in

Multi-factor authentication everywhere. Especially on email, remote access and administrative accounts. Stolen credentials are one of the most common entry points, and MFA is what makes them insufficient.

Close unnecessary external exposure. Remote desktop published directly to the internet is a recurring theme in ransomware incidents. Remote access should sit behind authenticated, monitored access — never open to anyone who finds the port.

Patch on a schedule. Internet-facing systems, firewalls and VPN appliances first. These are scanned constantly, and known vulnerabilities in them are exploited within days of disclosure.

Filter email properly. Attachment and link protection, plus SPF, DKIM and DMARC configured so your domain is harder to impersonate.

Train your team, and make reporting safe. Staff see the attack first. A click reported in five minutes is a manageable incident; the same click hidden for two weeks is not. That difference is cultural, not technical.

Limiting movement once someone is in

Assume, for planning purposes, that someone eventually gets in. The question becomes how far they can go.

Least-privilege access. Everyday accounts should not hold administrative rights. Administrators should use separate accounts for administrative work. This single change substantially slows escalation.

Network segmentation. Servers, workstations, guest Wi-Fi and any operational equipment separated, so a compromised laptop does not have a clear path to everything.

Endpoint detection and response. Traditional antivirus matches known bad files. EDR watches behavior — mass file modification, credential access, suspicious administrative activity — which is what actually shows up during the quiet phase. This is the control most likely to catch an intrusion before encryption.

Monitoring that someone reads. Alerts nobody sees are not detection. The value is in the response, not the log.

Making recovery survivable

Backups still matter enormously. They just need to be designed to survive the attack.

Keep at least one copy out of reach. Immutable storage that cannot be altered for a set period, or offline copies. The requirement is simple: compromising your network should not compromise your backups.

Use separate credentials. Backup systems should not be accessible with the same administrative accounts as the rest of the environment.

Test restores, and time them. Not just whether a file comes back, but how long a full recovery takes end to end. That number is what determines whether recovery is viable or theoretical.

Include Microsoft 365. Email, OneDrive, SharePoint and Teams data need a recovery point you control. Platform retention is not the same thing.

Keep enough history. If an intrusion began six weeks ago, backups covering only the last fortnight may all contain the attacker’s foothold.

Deciding in advance what you would do

Write down, before you need it: who is contacted first and in what order; who can authorise disconnecting systems from the network; where backups are and who can restore them; how staff communicate if email is unavailable; which clients, insurers or authorities may need to be notified; and who speaks for the business externally.

One page is enough. Its purpose is to remove the need to make consequential decisions at 3am while under pressure.

On paying

We are not going to tell you what to do in a situation we are not in. But some facts are worth knowing in advance rather than during.

Payment does not guarantee working decryption, does not guarantee stolen data is deleted, and funds the operation that will do this to someone else. In some jurisdictions there are legal restrictions on making payments to sanctioned entities. Insurers and regulators may have specific requirements about notification and about who may negotiate.

The realistic goal is to reach a position where paying is not the only option — which is what layered prevention plus survivable, tested backups actually buys you.

Where to start

If you are looking at this list and unsure where to begin: MFA everywhere, EDR on every endpoint, backups that cannot be reached from the network they protect, and a tested restore. Those four cover most of the realistic exposure for a small business.

Everything else builds on that foundation.

---

This article is general guidance and is not legal, regulatory or compliance advice. Technology and threats change — if you are making a decision based on it, check that it still reflects your current environment.