Practical steps to reduce ransomware likelihood and impact, and what to settle before an incident.
Ransomware is as much a resilience problem as a security problem. Preparation decides how long you are down and how much you lose.
Reduce the chance
- Patch internet-facing systems quickly
- Use multi-factor authentication on remote access and email
- Restrict administrator rights and monitor their use
- Filter email and train staff to report suspicious messages
Limit the damage
- Segment networks so one compromise does not reach everything
- Keep offline or immutable backups and test restoration
- Deploy endpoint detection and monitor it around the clock
Decide in advance
- Who leads the response and who has authority to take systems offline
- How you communicate if email is unavailable
- When to involve legal counsel, insurers, regulators and law enforcement
- Which systems are restored first
Practice
A tabletop exercise with technical and executive participants exposes gaps in your plan far more cheaply than a real incident.