Ransomware protection guide
Ransomware is the most destructive cyber threat facing businesses today. The average cost of a ransomware attack exceeds $4.5 million. Learn how ransomware works, how to prevent it, and how to recover if the worst happens.
Know the Threat
What is ransomware?
Ransomware is malicious software that encrypts your files or locks your systems and demands payment, usually in cryptocurrency, for the key to restore access. Modern ransomware operations are run by organized criminal enterprises with dedicated development teams, customer support, and negotiation specialists.
Crypto Ransomware
The most common variant. Encrypts your files using strong cryptographic algorithms (typically AES-256 combined with RSA-2048) and demands payment for the decryption key. Without the key, files are mathematically impossible to recover. Modern crypto ransomware also targets backup files and shadow copies to eliminate recovery options.
Locker Ransomware
Locks you out of your operating system entirely. You cannot access your desktop, applications, or files. A full-screen ransom message prevents any interaction. The underlying data is usually not encrypted, which means a skilled technician can often recover files by removing the hard drive and connecting it to another computer.
Double Extortion
Attackers steal your data before encrypting it, then threaten to publish the stolen information on leak sites if you refuse to pay. Even if you restore from backups, you face the risk of client data, trade secrets, or financial records being posted publicly. Over 70% of ransomware attacks now include data exfiltration.
Ransomware-as-a-Service (RaaS)
Criminal organizations build and maintain ransomware platforms, then lease them to affiliates who carry out the attacks. The RaaS operators handle the encryption technology, payment infrastructure, and decryption key management while affiliates focus on gaining access to victim networks. This model has dramatically lowered the barrier to entry for attackers.
Attack Vectors
How ransomware spreads
Understanding the most common entry points helps you prioritize your defenses where they matter most.
67%
of attacks
Phishing Emails
The most common delivery method. Attackers send emails with malicious attachments (Word documents with macros, PDFs with embedded scripts, or ZIP files containing executables) or links to compromised websites that download the ransomware payload. A single employee clicking one link can compromise your entire network.
16%
of attacks
Remote Desktop Protocol (RDP)
Attackers scan the internet for exposed RDP ports (TCP 3389) and brute-force weak credentials or use stolen passwords from previous breaches. Once inside, they have direct access to the system and can deploy ransomware across the network. Thousands of RDP credentials are sold on dark web marketplaces daily.
12%
of attacks
Software Vulnerabilities
Unpatched software provides attackers with known exploits to gain initial access. Critical vulnerabilities in VPN appliances, web servers, and remote access tools are routinely exploited within days of disclosure. The 2021 Kaseya VSA attack infected over 1,500 businesses through a single software vulnerability.
5%
of attacks
Supply Chain Attacks
Attackers compromise legitimate software vendors or managed service providers to distribute ransomware through trusted update channels. Because the malware arrives through a trusted source, it bypasses many security controls. These attacks can affect thousands of organizations simultaneously.
Defense in Depth
Ransomware prevention strategies
No single control stops ransomware. Effective defense requires multiple layers working together so that if one layer fails, the next catches the threat.
Email Security
- Deploy advanced email filtering with sandboxing to detonate suspicious attachments in a safe environment before delivery
- Block macro-enabled Office documents from external senders at the email gateway
- Implement DMARC, SPF, and DKIM email authentication to prevent domain spoofing
- Train employees monthly on recognizing phishing attempts with simulated phishing exercises
- Enable link rewriting and time-of-click URL scanning to catch delayed weaponization
Network Security
- Disable RDP on all internet-facing systems or restrict it behind a VPN with MFA
- Segment your network so that a compromise of one system does not give access to the entire environment
- Deploy next-generation firewalls with intrusion prevention and SSL inspection capabilities
- Monitor DNS queries for connections to known malicious domains and command-and-control infrastructure
- Implement zero-trust architecture where every access request is verified regardless of network location
Endpoint Protection
- Deploy EDR (Endpoint Detection and Response) on every endpoint with behavioral analysis capabilities
- Patch operating systems and third-party applications within 48 hours of critical security updates
- Disable PowerShell for users who do not need it and enable constrained language mode for those who do
- Enforce application whitelisting to prevent unauthorized executables from running
- Remove local administrator privileges from standard user accounts to limit malware execution scope
Access Controls
- Require multi-factor authentication on all accounts, especially administrative and remote access accounts
- Implement the principle of least privilege: users should only have access to the resources required for their job
- Use privileged access management (PAM) tools to vault and rotate administrative credentials
- Disable dormant accounts and review access permissions quarterly
- Deploy conditional access policies that block logins from unusual locations or unmanaged devices
When Prevention Fails
Ransomware recovery plan
Even with strong defenses, you need a plan for the worst-case scenario. Organizations with a tested incident response plan reduce the average cost of a ransomware attack by over $2 million.
Isolate Immediately
Disconnect infected systems from the network immediately. Unplug Ethernet cables and disable Wi-Fi. Do not power off the systems as this may destroy forensic evidence in memory. The goal is to stop lateral movement and prevent the ransomware from spreading to additional systems, file shares, and backup infrastructure.
Assess the Scope
Determine which systems are affected, what data was encrypted, and whether data was exfiltrated. Check if backups are intact and uncompromised. Identify the ransomware variant using the ransom note, encrypted file extensions, or services like ID Ransomware. Some older variants have known decryption tools available for free.
Report the Incident
Notify law enforcement (FBI IC3 or local field office), your cyber insurance carrier, and legal counsel. Many jurisdictions require breach notification within specific timeframes. Your cyber insurance carrier should be contacted before engaging any incident response firms to ensure coverage and approved vendor lists.
Activate Your Incident Response Plan
Follow your documented incident response plan. Engage your incident response team or retained IR firm. Establish communication channels outside the compromised network (personal phones, alternate email). Assign roles: incident commander, communications lead, technical lead, and legal liaison.
Restore from Backups
Begin restoring systems from verified clean backups, starting with the most critical business systems. Verify backup integrity before restoring. Rebuild systems from clean images rather than simply decrypting files to ensure no persistent backdoors remain. Test restored systems in an isolated environment before reconnecting to the production network.
Harden and Monitor
Before bringing restored systems back online, patch the vulnerability that allowed initial access, reset all credentials, and deploy enhanced monitoring. Assume the attacker still has access until proven otherwise. Conduct a thorough review within 30 days to document lessons learned and update your security controls.
Your Last Line of Defense
Why backups are your most critical defense
Reliable, tested, immutable backups are the single most important factor in ransomware recovery. Organizations with verified backups recover in days. Those without can be down for weeks or permanently lose their data.
- Follow the 3-2-1-1 rule: 3 copies, 2 different media types, 1 off-site, and 1 immutable or air-gapped copy that ransomware cannot reach
- Implement immutable backups that cannot be modified or deleted for a defined retention period, even by administrators
- Air-gap at least one backup copy by physically disconnecting it from the network after each backup cycle
- Encrypt all backups with AES-256 encryption and store encryption keys separately from the backup infrastructure
- Test backup restoration monthly. A backup that has never been tested is a backup you cannot rely on during an incident
- Monitor backup jobs daily for failures, and investigate any backup that fails to complete successfully
- Ensure your backup solution can restore individual files, entire systems, and bare-metal images depending on the recovery scenario
- Store backup credentials in a separate identity system so that compromised domain credentials cannot be used to delete backups
Build your ransomware defense today
Our team assesses your current defenses, identifies gaps, deploys layered protection, and builds an incident response plan so you are prepared before an attack, not scrambling during one.
Schedule Free Consultation