Most ransomware advice is about prevention, and prevention is worth doing. But the businesses that recover well are not the ones that were impossible to compromise — there is no such thing. They are the ones that had already answered the questions below.
None of these need a large budget. They need decisions made in advance.
Can you restore, and how long does it take?
This is the question that determines whether a ransom is even a consideration. Not “do we have backups” — whether you have restored from them recently, into a clean environment, with the time recorded. If the last verified restore was more than a quarter ago, the honest answer is that you do not know.
And the backups have to be immutable. A repository reachable with normal credentials from a compromised machine gets encrypted along with everything else. That is not an edge case; it is the standard attack sequence.
Do you know what normal looks like?
Detection is largely a comparison against a baseline. If nobody knows what typical traffic, login patterns and file access look like on an ordinary Tuesday, then the unusual activity that precedes encryption — credential probing, lateral movement, mass file reads — passes unremarked. This is why monitoring has value even without a full security operations centre: you cannot notice a deviation from a baseline you never established.
Who decides, and who calls whom?
At 2am on a Friday, someone has to decide to disconnect production. Establish now:
- Who has the authority to take systems offline, and their deputy
- How the team communicates if email and chat are unavailable — a phone tree on paper is not old fashioned, it is resilient
- Who contacts your insurer, your regulator and affected customers, and within what timeframe
- Which external help you would call, and whether you already have their number
How far can one compromised machine reach?
This is a network design question, and it is the one with the biggest effect on the size of the incident. On a flat network the answer is “everything”. With segregation, administrative accounts that are not used for daily work, and management interfaces reachable only from named machines, the answer becomes a much smaller list. We wrote about this in more detail in our piece on network segregation.
Are you patching the things that are actually exposed?
Patching everything equally is neither achievable nor useful. What matters is a ranked view: what is reachable from the internet, what has a known exploited vulnerability, what holds the data that would hurt most. Scan, rank by real risk, remediate, then re-scan to confirm the fix — and keep the record, because it is also your audit evidence.
The uncomfortable rehearsal
Once a year, put the relevant people in a room for ninety minutes and walk through a scenario out loud. No systems touched. Just: it is Friday evening, finance reports files are inaccessible, what happens next, who does what, in what order. Every organisation that does this finds at least two assumptions that were wrong, and finding them in a meeting room is considerably cheaper than finding them during an incident.
Detection, containment and recovery — with the response time agreed in advance. Cyber Security →
