Ransomware locks your files and demands payment to unlock them. Attackers go after small businesses too, because they assume smaller companies have fewer defenses. A single click on a bad email attachment can stop your sales, billing, and customer service for days.
You cannot make yourself completely safe, but these ten steps make you a much harder target and let you recover faster if something does happen.
Prevent
- Turn on multi-factor authentication (MFA). Require a second step for email, remote access, and cloud tools. Stolen passwords alone then fail.
- Keep everything updated. Install updates for operating systems, applications, firewalls, routers, and cameras. Attackers exploit known flaws that were fixed long ago. Replace equipment that no longer gets updates.
- Filter email and train your team. Most attacks start with a phishing email. Use spam and attachment filtering, and teach staff to pause before clicking links, opening unexpected attachments, or acting on urgent payment requests.
- Use endpoint protection. Modern security software on every computer and server, centrally managed so you know it is running.
- Limit access. Give people only the files and systems they need. Avoid daily work with administrator accounts, and remove access for former staff right away.
Contain
- Segment your network. Keep guests, cameras, printers, and business computers on separate networks so an infection in one place cannot easily spread everywhere.
- Secure remote access. Avoid exposing remote desktop to the internet. Use a VPN or secure gateway with MFA, and turn off services you do not use.
- Protect your Wi-Fi and network devices. Change default passwords and use strong encryption. Review our list of warning signs your network needs a security review.
Recover
- Back up in a way ransomware cannot reach. Follow the 3-2-1 idea: three copies of your data, on two different types of storage, with one copy offline or otherwise isolated. A backup that is always connected to your network can be encrypted along with everything else. Test restores regularly.
- Write a simple response plan. Know who to call, how to disconnect infected computers, where backups are, and how you will communicate with staff and customers if systems are down. Print it, since you may not be able to open it during an attack.
If You Are Hit
- Disconnect affected computers from the network and Wi-Fi right away. Do not turn off power unless advised, since this can destroy evidence.
- Call your IT provider or a cybersecurity professional.
- Do not rush to pay. Law enforcement generally advises against paying, and payment does not guarantee you will get your files back.
- Report the attack to law enforcement, and check with your attorney and insurer about notification duties, particularly if customer or employee personal information may be involved.
- Restore from clean backups after the cause has been found and closed.
Remember that your physical setup matters too. Locked network rooms, access control, and cameras protect the equipment ransomware depends on you not guarding. See our network closet checklist and access control guide. This article is general information, not a guarantee of protection.
Strengthen Your Defenses With Scio Info Tech
We help businesses across the San Francisco Bay Area, Sacramento, Los Angeles, and California with IT security, network management, and the physical infrastructure behind it. Tell us about your setup and we will help you close the biggest gaps first.
