10 ways to protect your business from ransomware

Ransomware is malicious software that makes files or systems unusable and demands payment in exchange for restoring access. Attackers often copy data before encrypting it and threaten to publish it if they are not paid. For a business, the problem is not just encrypted files; sales, production, accounting, customer service and reputation can all be hit at once. No single product can eliminate the risk, but measures applied consistently reduce both the likelihood of an attack and its impact.

Start by identifying critical work and data

Begin your protection work not with "which computer matters most?" but with "which data and applications does our business depend on?". List your ordering system, accounting, customer lists, project files, email and shared folders. For each item, note who is responsible, where the data lives and what happens if it becomes unavailable. Update the list whenever a new device or cloud service is added; a forgotten system can become an unpatched, unmonitored way in.

Ten essential measures

1. Keep backups separate and test restores

Store several copies of critical data on different media or accounts. Backups that remain permanently reachable on the same network can be encrypted too, so keep at least one copy disconnected from the network (offline) or protected against deletion for a set period (immutable). Separate the backup account from everyday user accounts and restrict delete and modify permissions. Seeing that a backup ran is not enough: restore sample files and applications at regular intervals.

2. Keep on top of updates

Assign someone to be responsible for updates to operating systems, servers, network devices and applications. Prioritise and schedule security fixes, especially for systems reachable from the internet (such as VPNs, firewalls and email servers). For software that has reached end of support, plan to replace it, switch it off or isolate it from the network.

3. Tidy up passwords and administrator accounts

Use a long, unique password for every account, and consider a password manager to store them securely. Administrator accounts should not be used for everyday email and browsing; anyone who needs admin rights should have a separate account for that purpose. Shared accounts should have a recorded owner, purpose and end date.

4. Roll out multi-factor authentication

Multi-factor authentication asks for a second check on top of the password and is a priority for email, remote access, cloud storage and administrator accounts in particular. Also establish who controls the recovery methods (backup phone numbers, recovery email addresses, backup codes).

5. Keep email awareness alive

An unexpected attachment, a fake invoice or a link can be where an attack begins. Staff should know how to check the sender, the context of the request and where a link really leads. Make it clear who suspicious messages should be forwarded to and who to call if someone makes a mistake.

6. Restrict remote access

Close remote access routes you do not use and protect the remaining ones with multi-factor authentication. Rather than exposing services such as Remote Desktop (RDP) directly to the internet, place them behind a VPN or a similar secure access layer. Review any management panels exposed to the internet, and regularly remove accounts belonging to former staff, contractors and temporary users.

7. Segment your network

If guest Wi-Fi, camera systems, user computers and servers can all reach each other freely on the same network, an infection on one device spreads more easily to the rest. Decide which systems actually need to communicate and restrict everything else. For a small business, separating the guest network from the business network is a good start.

8. Monitor your protection tools

Make sure the protection software on computers and servers is up to date and running. Decide in advance who receives alerts, who reviews them and what happens when a serious alert comes in. Firewall and server logs are useful in an investigation; check that they are kept for long enough.

9. Apply the principle of least privilege

Give everyone only the access their job requires. Review who can read, modify and delete in shared folders and cloud applications. When an account with broad write access is compromised, the number of files that can be affected grows accordingly. Make permission reviews a step in your joiner, role-change and leaver processes.

10. Write a short incident plan

Write down the first steps to take when unusual file extensions or a ransom note appear: disconnect the affected device from the network (unplug the cable, turn off Wi-Fi), notify the technical lead immediately, and do not delete files or logs. Agree who will brief management, which services will be checked first and whom to contact if outside help is needed. Keep a printed or offline copy of the plan; it must be available even when your systems are not.

Tie each measure to a date and an owner

Instead of trying to do everything at once, start with critical areas such as email, administrator accounts, remote access and backups. Turn each measure into a small work package with an owner, a target date and evidence of completion. For example, in the first month inventory the accounts reachable from the internet, in the second roll out multi-factor authentication more widely, and in the third run a restore test. Rather than simply saying "done", define the evidence: a restored sample file, an approved access list or an updated plan.

Plan changes around the business calendar. Month-end close, a busy sales period or a critical production shift all affect when maintenance can happen. Announce maintenance windows in advance and decide who will make the call to roll back if something unexpected happens.

If you use an outside provider, keep responsibility with someone inside the organisation. You should know which systems the provider can access, how to reach them in an emergency and where changes are recorded. When the relationship ends, removing their accounts, remote access tools and shared keys is part of the plan too.

Test the plan with a tabletop exercise at least once a year. The aim is not to find fault but to improve communication, decision-making and the restore process before a real crisis. Don't measure success only as "nothing happened"; indicators such as how long a restore took, how many old accounts were closed and how many alerts were resolved show whether your preparedness is genuinely improving.

Checklist

• Are critical systems, data and their owners on an up-to-date list?
• Are backups kept separately, with at least one offline or immutable?
• Are restores tested at regular intervals?
• Are updates for internet-facing systems applied as a priority?
• Is multi-factor authentication enabled for email, remote access and administrator accounts?
• Are administrator accounts separate from everyday accounts?
• Are the guest network, business network and critical systems separated?
• Do staff know whom to report a suspicious email to?
• Is the incident plan written down and accessible even when systems are down?