Ransomware Protection: The Four-Layer Strategy That Actually Works

What a ransomware solution actually is

There's no single product that solves ransomware. Anyone selling you one is selling you a piece of the answer.

A real solution is a stack of four things: keeping attackers out, limiting how far they get, being able to restore without paying, and knowing what you'll do on the worst day. Most small and midsize businesses have part of the first and almost none of the other three.

Let's take them in order of how much they matter.

Start with backups, because they decide everything

If you can restore your systems from clean copies, a ransomware attack becomes an expensive bad week. If you can't, it becomes a question of whether the company survives.

The old rule still holds: 3-2-1. Three copies of your data, on two different types of storage, with one copy offsite. Modern attackers know this rule too, so add a fourth word: immutable. An immutable backup can't be altered or deleted for a set period, even by an administrator account. That matters because attackers usually hunt down your backup console before they encrypt anything.

Here's what I'd do for a business with 20 to 200 employees:

Back up critical servers and databases daily at minimum. Every 4 hours if losing a day of orders or transactions would hurt.
Keep immutable copies for 14 to 30 days. That's a rule of thumb, not a measured figure. Attackers often sit inside a network for days before striking, so you want restore points older than the intrusion.
Store one copy somewhere your everyday admin credentials can't reach.
Test a restore every quarter. Not a file-level spot check. Restore a whole server to a spare environment and time it.

That last item is the one people skip. A backup you've never restored is a hope, not a backup.

Close the doors attackers actually use

Most ransomware gets in through a short list of routes: stolen or guessed passwords on remote access, phishing emails, and unpatched internet-facing systems. Fix those and you've removed most of the easy paths.

Multi-factor authentication. Turn it on for email, VPN, remote desktop, and every admin account. Use an authenticator app or a hardware key rather than text messages where you can. Cost is typically $0 to $6 per user per month, and it's the cheapest control on this list.

Patching. Apply critical patches to anything facing the internet within 7 to 14 days. Firewalls, VPN appliances, and mail servers come first. Everything else can follow a monthly cycle.

Remote desktop. Don't expose it to the internet. Put it behind a VPN or a gateway that requires MFA. Open RDP ports get scanned constantly.

Email filtering. A decent filter with attachment sandboxing runs roughly $2 to $5 per user per month. It will catch things your staff shouldn't have to judge.

Limit the blast radius

Assume someone gets in. What can they reach?

In a flat network, everything. One infected laptop can see every file share and server. That's how a single click turns into a company-wide outage.

Three changes help most:

Remove local admin rights from everyday user accounts. Malware running as a normal user can do far less.
Separate admin accounts. Your IT person should have one account for email and another for administration. If the daily account is phished, the keys to the kingdom aren't in it.
Segment the network. At minimum, put servers, backups, and user devices on separate segments with firewall rules between them.

I'd rank these above buying more security software. Architecture beats gadgets.

Endpoint protection: pick one that watches behavior

Traditional antivirus matches known signatures. Ransomware authors change their code constantly, so signature matching alone misses new variants.

You want endpoint detection and response (EDR), which watches for behavior like a process rapidly renaming thousands of files. Expect to pay around $5 to $15 per device per month, depending on the vendor and whether someone monitors alerts for you.

That second part is where I'd take a firm position. For a company without a dedicated security person, buy a managed service, often called MDR, rather than a self-run EDR console. An alert at 2 a.m. that nobody reads protects nothing. Paying a bit more per device for humans who respond is the better deal. If you have a real security team, self-managed is fine.

Skip the "ransomware-specific" add-on tools that overlap with a good EDR. You'd be paying twice for the same detection.

Write the plan before you need it

When an attack hits, people make bad decisions fast. A one-to-two page plan prevents most of them.

It should answer:

Who's in charge, and who's their backup?
Who do you call first? Your IT provider, your cyber insurer, and a breach attorney, with phone numbers that don't depend on your email system.
How do you isolate affected machines? (Usually: unplug the network cable or disable Wi-Fi, and leave the power on.)
Which systems come back first, and in what order?
Who talks to customers and staff, and what do they say?

Print it. Your shared drive might be encrypted.

Run a tabletop exercise once a year. Gather the key people for an hour, describe a scenario, and ask who does what. You'll find gaps within the first ten minutes.

Should you pay the ransom?

My answer: plan so that you never have to, and don't count on payment working.

Paying doesn't guarantee you get usable decryption tools, and decryption of large data sets is slow even when it works. It may also create legal problems, since payments to sanctioned groups can violate regulations in some countries. Talk to counsel and your insurer before any decision. Law enforcement agencies generally ask victims to report incidents, and it's worth doing.

Cyber insurance is worth having, but read the application carefully. Insurers now commonly require MFA, tested backups, and endpoint protection before they'll cover you. Premiums for a small business often run from a few thousand to tens of thousands of dollars a year, depending on revenue and industry. That's a rough range. Get quotes.

A sensible order of operations

If you're starting from nothing, here's the sequence I'd follow:

Week 1: Turn on MFA everywhere. Check that your backups exist and where they live.
Weeks 2 to 4: Make one backup copy immutable and offsite. Remove open remote desktop access.
Month 2: Deploy managed EDR. Strip local admin rights.
Month 3: Write the response plan and test a full restore.
Ongoing: Patch on schedule, review access quarterly, run a yearly exercise.

Total cost for a 50-person company usually lands somewhere between $1,000 and $3,000 a month, including backup storage, EDR, and email filtering. Compare that with a typical week of downtime for a business your size, and the math tends to settle itself.