Most ransomware advice is a list with no order, which is useless when the budget is finite. This is the same list, ranked by how much risk each item removes for what it costs.
Ransomware does not usually break in. It is let in — through a stolen password, a remote access port left open, or an attachment somebody opened because it looked like an invoice.
That is good news, because it means the defences are mostly things you can do rather than things you must buy.
1. Backups that the attacker cannot reach
This is first because it is the only control that decides whether an incident is expensive or catastrophic. Everything else reduces the chance; this determines the outcome.
The critical property is not that a backup exists. It is that a compromised administrator account cannot delete it. Modern ransomware crews look for the backup system deliberately and encrypt or wipe it before triggering anything, precisely because they know it is the difference between paying and not paying.
- Immutable or offline copies that cannot be altered once written.
- Separate credentials from your normal administrator accounts.
- Restore tested on a real system, timed, and recently.
- Retention long enough to predate the intrusion, which may be weeks before the encryption.
2. MFA everywhere, enforced
Stolen credentials are the most common entry route. MFA closes most of it, but only where it genuinely applies — legacy authentication protocols bypass the prompt entirely, and they remain enabled on a surprising number of tenants.
3. Close remote access that should not be open
Remote Desktop exposed to the internet remains one of the most reliably exploited entry points for small business ransomware. If a vendor asked for a port to be opened years ago and nobody closed it, that is worth finding this week.
4. Endpoint detection, not just antivirus
Traditional antivirus matches known files. Modern ransomware is frequently unique to the campaign. EDR watches behaviour — mass file modification, shadow copy deletion — and can stop it partway rather than recognising it in advance.
5. Remove local administrator rights
A great deal of ransomware needs administrator rights to encrypt broadly and to delete recovery points. A user who is not an administrator limits the blast radius, and it costs nothing but the argument about it.
6. Patch the things facing the internet first
Firewalls, VPN appliances and mail servers, in that order. An unsupported on-premises Exchange Server facing the internet is, bluntly, the single most dangerous thing a small business can still be running.
Notice what is not on this list: security awareness training. It is worth doing and it is not a control — it reduces the frequency of the first click, not the consequences of it. Treating training as a defence is how businesses end up trained and encrypted.
If it happens anyway
- Disconnect affected machines from the network. Do not power them off — memory can hold useful evidence and, occasionally, keys.
- Do not start deleting or reimaging until scope is established.
- Call your insurer early. Many policies require notification before you engage anyone.
- Assume data was taken as well as encrypted. Exfiltration before encryption is now standard, and it changes your notification obligations.
Frequently asked
Should we pay?
A business and legal decision rather than a technical one, and it carries sanctions exposure your counsel needs to weigh. What we would contribute is an accurate picture of what is encrypted, what your backups can restore and how long recovery would take — which is usually what the decision actually turns on.
Will cyber insurance cover it?
If the controls you declared on the application were genuinely in place. That sentence is the reason to answer those forms carefully.
Does Microsoft 365 protect us from ransomware?
Partly. It has useful detection, and OneDrive version history can help. But encrypted files sync, and Microsoft does not hold a backup of your data on your behalf — that is your responsibility under their shared responsibility model.
We are five people. Are we really a target?
Targeting is largely automated and indiscriminate. Small businesses are hit because they are reachable and under-defended, not because anyone chose them.