Ransomware is not primarily a malware problem any more; it is an access problem. Most incidents we review began with a valid credential — phished, reused, or bought — or with a remote-access service exposed to the internet. The malware arrives last, after the attacker has already mapped the environment and located the backups.

Backups are the whole game, and most fail the same way

Attackers delete or encrypt backups first, because they know it is the deciding factor. A backup connected with standing write credentials from the same environment is not a backup for this purpose. You need at least one copy that is offline, immutable, or in a separate account with its own credentials — and a restore that someone has actually performed, end to end, and timed. An untested backup is an assumption.

Close the common entry points

  • No remote desktop or management interface exposed directly to the internet.
  • Phishing-resistant multi-factor authentication on remote access, email, and VPN.
  • Remove standing local administrator rights from day-to-day accounts.
  • Patch internet-facing systems on a schedule you can evidence, not when convenient.
  • Disable accounts of departed staff on their last day, including service accounts they created.

Limit how far one compromise reaches

Flat networks where any workstation can reach every server are what turn a single infected machine into a full outage. Segment where you can, restrict which systems can reach file servers and backups, and ensure that administrative credentials are not reused across every system — credential reuse is how attackers move laterally.

Decide the payment question in advance

Have the conversation while calm: whether you would consider paying, who decides, whether your insurer requires notification first, and what your legal exposure is in your jurisdiction. Paying does not reliably restore data and funds further attacks, but deciding under pressure with systems down produces worse decisions than deciding in advance.

When it happens

  • Isolate affected systems from the network, but do not power them off — memory can hold evidence.
  • Preserve disk images and logs before rebuilding anything.
  • Notify your insurer early; many policies require it before you engage responders.
  • Assume data was taken as well as encrypted, and check your breach-notification obligations.
  • Reset credentials broadly after containment, including service accounts.

What to do this week if nothing above exists

Test a restore, turn on phishing-resistant multi-factor authentication for email and remote access, and remove any management interface exposed to the internet. Those three are achievable in days, cost little, and address the mechanisms behind most of the incidents that actually happen.