Ransomware Protection for Businesses: Prevent, Prepare and Recover

• Phishing emails that trick an employee into opening an attachment, clicking a link or entering a password.
• Stolen or reused passwords on accounts that do not use multi-factor authentication.
• Unpatched systems, such as computers, servers and firewalls that are missing security updates.
• Exposed remote access, such as remote desktop or VPN connections open to the internet without MFA.
• Vendor and outside access that is broader than it needs to be or was never removed.

• Turn on multi-factor authentication for email, Microsoft 365, remote access and administrator accounts.
• Run endpoint protection on every computer and server, with someone watching its alerts.
• Apply security updates to operating systems, applications and network devices on a schedule.
• Limit administrator rights, and use separate accounts for admin work.
• Filter email for phishing and malware, and teach employees to report suspicious messages.
• Close remote access that is not needed, and require MFA on the rest.
• Replace devices that no longer receive security updates. See when to replace business IT equipment.

• Back up servers, key applications and Microsoft 365 email and files.
• Keep at least one copy offline, immutable or otherwise separated from your main network, so ransomware cannot encrypt or delete it.
• Protect backup systems with separate credentials and multi-factor authentication.
• Test restores on a schedule, and know how long a full recovery would take.
• Agree in advance which systems come back first. See backup and disaster recovery.

1. Disconnect affected computers from the network, including Wi-Fi, to stop the spread.
2. Call your IT provider right away, and do not wipe or rebuild computers until the cause is understood.
3. Contact your cyber insurer early. Many policies require prompt notice and may require approved response firms.
4. Report the attack to the FBI through its Internet Crime Complaint Center (IC3).
5. Reset passwords and review accounts once the attacker’s access has been removed.
6. Restore from clean backups in the agreed order, after confirming the backups are not infected.

The FBI does not support paying a ransom. Paying does not ensure that files will be restored or that stolen data will be deleted, and it rewards the criminals behind the attack.

The decision is a business and legal one, often made with your insurer and legal counsel. The best position is not to need it: tested backups and a practiced recovery plan give you another way back.

Write a short response plan: who to call, who decides, how to reach employees if email is down and where the contact details for your insurer and IT provider are kept. Review it at least once a year. For the wider plan, see our business continuity plan checklist.

Make it easy to report a suspicious email or an unexpected pop-up, and thank people who do. Early reports stop many attacks before they spread.

Endpoint protection, security patching and 24/7 monitoring are included on every managed workstation and server. Our cybersecurity services add multi-factor authentication, conditional access, identity protection and Microsoft 365 security, and network security services cover firewalls and secure remote access.

Backup and disaster recovery covers backups and tested recovery, so restoring systems after an attack is planned in advance. Preparing for a cyber insurance renewal? See our cyber insurance requirements checklist.