Ten Steps to Prepare for Ransomware

Ransomware remains the most destructive cyber threat for organisations. Attackers no longer just encrypt data; they copy it first and threaten to publish it if no payment is made (double extortion). In the cases we respond to, the common denominator is this: prepared organisations recover within hours while unprepared ones stop production for weeks.

1. Asset inventory

You cannot protect a system you do not know about. Keep a current list of all servers, endpoints, cloud assets and internet-facing services.

2. Multi-factor authentication

MFA must be mandatory on all remote access points, including VPN, e-mail, remote desktop and admin consoles. Stolen passwords are the most common way in.

3. Patch management

Critical patches on internet-facing systems should be applied within seven days, others within 30. Actively exploited vulnerabilities take priority.

4. Endpoint detection and response (EDR)

Traditional antivirus does not see the reconnaissance and lateral movement that precede ransomware. Consider EDR and 24/7 monitoring together.

5. Network segmentation

Separate production, office, guest and backup networks. When an attacker lands on one point they should not be able to roam the whole network.

6. Privileged account management

Do not use admin accounts for daily work; keep admin passwords in a vault and apply tiered administration.

7. Immutable backups

The 3-2-1 rule: three copies, two different media, one offline or immutable. Most importantly, test restores regularly.

8. E-mail security

SPF, DKIM and DMARC policies with advanced threat protection; sandbox analysis for macro-enabled and archive attachments.

9. Incident response plan and exercises

Who decides, who gets called, which systems are restored first? A written plan and at least one tabletop exercise a year are essential.

10. Retainer agreement

Searching for a new provider during an attack wastes time. A pre-signed incident response agreement makes a decisive difference in the first two hours.

Applying these ten steps does not reduce the probability of attack to zero, but it dramatically shortens impact and recovery time. With our maturity test you can see today where you stand.

What to do in the first hour of an attack

• Disconnect affected devices from the network; do not power them off so memory evidence is preserved.
• Do not restore until you have verified that backups are unaffected.
• Copy the ransom note and sample encrypted files.
• Call the incident response team and legal counsel at the same time.
• Do not leave the decision on paying the ransom to the technical team; it should be made at management level with legal assessment.