Ransomware is software that encrypts your files and demands payment for the key. Most modern attacks add a second threat: the criminals copy your data first and promise to publish it. Recovering from backups solves the first problem. It doesn't solve the second.
That's why no single product counts as a solution. What works is a handful of ordinary controls, done well and tested.
How attacks usually get in
Attackers rarely break in with anything clever. The common routes are stolen or guessed passwords on remote access, phishing emails that deliver a loader, and unpatched internet-facing systems such as VPN appliances and mail servers.
Once inside, they spend days or weeks exploring. They look for admin credentials, find your backups, and delete or encrypt them. Only then do they trigger the encryption.
Your defenses have to cover that whole window, not just the moment of infection.
Backups that can't be erased
Backups are the control that turns a catastrophe into an irritating week. But only if the attacker can't reach them.
The old 3-2-1 rule still holds: three copies of your data, on two kinds of storage, with one copy offsite. Add a fourth requirement for today: at least one copy must be immutable, meaning nobody can alter or delete it until a retention period expires, not even an administrator.
Some practical numbers:
- Frequency: Daily is the floor. For databases and file servers people work in all day, every 1 to 4 hours is a sensible target.
- Retention: Keep 30 to 90 days of history. Attackers often sit in a network for a while, and you don't want every copy to contain their foothold. This is a rule of thumb, not a measured figure.
- Cost: Immutable cloud object storage typically runs somewhere between $5 and $25 per terabyte per month, depending on provider and features. For most small and midsize businesses, that's cheap insurance.
I'd pick immutable cloud storage over tape rotation for any organization without a dedicated infrastructure team. Tape is reliable, but it depends on someone physically swapping and storing it, and that routine tends to lapse. A setting in a cloud console that enforces retention doesn't get tired.
Test the restore, and do the math
A backup you've never restored is a hope.
Restore a sample file monthly. Restore a whole critical system at least quarterly. Time it.
Then check your bandwidth. Pulling 10 TB over a 1 Gbps link takes about 22 hours at perfect speed, and real-world throughput is usually worse. If your business can't be down for that long, plan to restore into cloud infrastructure or keep a local copy for fast recovery. Better to learn that now than at 3 a.m. during an incident.
Close the doors attackers use most
Multi-factor authentication comes first. Turn it on for email, VPN, remote desktop, and every admin account. Authenticator apps or hardware keys beat text messages, but text messages beat nothing. Licensing usually costs a few dollars per user per month, a rule-of-thumb range of $3 to $8.
Patching comes second. Internet-facing systems matter most. CISA maintains a Known Exploited Vulnerabilities catalog, which is a good list of what to fix first because those flaws are already being used in attacks. A reasonable internal target: critical patches on exposed systems within 14 days, sooner if the flaw is in that catalog.
Remote desktop comes third. Never expose RDP directly to the internet. Put it behind a VPN or a gateway with MFA.
Admin accounts come fourth. Nobody should read email or browse the web with an account that can reconfigure the network. Separate the accounts. It's mildly annoying, and it removes a favorite attacker shortcut.
Detect it in the first hour
Traditional antivirus matches known signatures. Ransomware crews change their tools constantly, so you want something that watches behavior: a process suddenly rewriting thousands of files, a new tool dumping credentials, a backup service being stopped.
That's what endpoint detection and response (EDR) does. The catch is that an EDR alert at 2 a.m. is useless if nobody reads it.
Which is why I'd choose a managed detection and response service over buying EDR and running it yourself, unless you already have people on call around the clock. Pricing varies, but $8 to $20 per endpoint per month is a common range. Treat that as a rough guide and get quotes.
I wouldn't bother with a pile of extra point products layered on top. Three tools nobody tunes are worse than one that someone watches.
Limit how far it can spread
Assume something will eventually get in. The question is how much it can touch.
- Split your network so workstations can't talk directly to each other or to servers they don't need.
- Keep backup systems off the main domain, with separate credentials.
- Give people access to the shares they use, not to everything.
- Disable macros in files downloaded from the internet.
None of this is exotic. It's mostly configuration work, and a competent IT person can make real progress in a few weeks.
Write the plan before you need it
During an attack, people make bad decisions fast. A one-to-two-page plan prevents most of them.
Include who has authority to shut systems down, who calls your insurer, your lawyer, and your IT provider, and how you'll communicate if email is gone. Print it. Phone numbers stored on the encrypted server won't help anyone.
Run a tabletop exercise once a year. It takes about two hours: gather the key people, read out a scenario, and see who's confused about what. You'll find gaps every time.
Should you pay?
Law enforcement agencies, including the FBI and CISA, advise against paying. I agree, with one honest caveat.
Payment doesn't guarantee a working decryptor, and it doesn't guarantee the stolen data gets deleted. It also marks you as a payer. Depending on the group involved, it can create sanctions problems too, which is a matter for your lawyer before any decision.
But if you have no usable backups and the business will fail without the data, the choice gets painful. That's the best argument for the backup work above. Good backups remove the dilemma.
Cyber insurance is worth having for incident response help and legal costs. It's not a substitute for controls. Insurers now ask about MFA and backups before they'll quote, and they'll deny claims over false answers.
What I'd do first on a tight budget
If you have limited money and a few weeks, here's the order:
- Enforce MFA on email, remote access, and admin accounts. Time: days. Cost: low.
- Set up an immutable, offsite backup and restore one system from it.
- Patch or remove anything exposed to the internet that's out of date.
- Add managed endpoint detection.
- Write the one-page response plan and print it.
That list won't make you invulnerable. Nothing does. But it handles the most common attack paths and, more important, it means a successful attack costs you a bad week rather than the business.
Start with the backup test. Today, if you can.