How to Protect Your Business Against Ransomware

Ransomware encrypts your files and systems and demands payment to restore them. Some groups also steal data first and threaten to publish it. Protection comes down to making attacks harder to start, harder to spread and easier to recover from.

Reduce the ways in

• Require MFA on email, remote access and administrator accounts
• Patch internet-facing systems quickly
• Remove or secure remote desktop access exposed to the internet
• Filter email and teach staff to report suspicious messages

Limit how far an attack can spread

• Use endpoint protection with behavior-based detection on every device
• Restrict administrator privileges and use separate admin accounts
• Segment the network so critical systems are isolated

Make recovery possible

Backups are your safety net, but only if attackers can't reach them. Keep at least one copy offline or immutable, protect backup systems with MFA and test restores regularly.

Prepare your response

Write a plan that covers how to isolate affected systems, who makes decisions, how to reach your IT provider, insurer and legal counsel, and how to communicate with staff and customers. Rehearse it with a short tabletop exercise.

If you're hit

Disconnect affected devices from the network without powering them off, preserve evidence and contact your incident response support before making decisions about recovery.