Ransomware: how to protect your company before an attack
Ransomware attacks often begin with something routine: an attachment opened in a hurry, a reused password, or a server that has fallen behind on updates. Reducing the risk takes several controls working together well before an incident. Isolated backups, two-factor authentication, least-privilege access, timely updates, and continuous monitoring form the baseline.
How ransomware gets in
Ransomware can enter through a message that impersonates a supplier or mimics an expected invoice. Opening an attachment or link can give the attacker an initial foothold on the internal network. Another route is a compromised account: a reused or stolen password may be enough to access an internet-facing service.
Attackers can also exploit unpatched vulnerabilities in servers or network equipment. Consistently applied controls reduce the risk from each of these entry points.
Isolated, restore-tested backups
An isolated, restore-tested backup gives your company a reliable recovery path. To remain useful, it must be separated from the network where production systems run. If attackers can reach it with the same accounts and permissions, they may encrypt or delete it along with the systems and data it was meant to protect. We configure backups managed through Azure Backup or Veeam so that workstations cannot access them directly.
Verification matters just as much. A backup job that completes without errors does not prove that the data can be restored completely and on time. We test restores regularly, so we know the recovery process works before an incident occurs.
Two-factor authentication and least privilege
Two-factor authentication reduces the chance that a stolen password will grant immediate access. We enable it for email, remote access, and administrator accounts, where a compromise would have the greatest impact.
Least-privilege access limits what a compromised account can reach. We grant each role only the permissions it needs and revoke access on an employee's last day, not at the end of the month.
Updates, endpoint protection, and monitoring
We apply security updates to operating systems, servers, and network equipment on a defined schedule rather than whenever someone remembers. This reduces the window in which a known vulnerability can be exploited.
We use remote monitoring and management (RMM) to track the health of managed devices. Endpoint security tools detect and block suspicious activity, including mass-encryption attempts. Monitoring runs 24/7, and the contract sets a maximum response time of 1 hour for critical incidents.
- Two-factor authentication for business: priorities and rollout
- We have backups. But does recovery actually work?
- GDPR at a small company: the IT side and the legal side
- NIS2 for small businesses: how it actually affects you
- How to spot a phishing email (and prepare your team)
- Ransomware: what to do in the first hour