Ransomware Protection: A Practical Defence Guide for Businesses

Ransomware is malware that encrypts an organisation's files and systems, followed by a demand for payment to restore them. Modern gangs also steal data first and threaten to publish it, a tactic called double extortion. Ransomware is now one of the most damaging threats businesses face, in Pakistan and worldwide.

How a ransomware attack unfolds

Encryption is the last step, not the first. Attackers are often inside for days or weeks before it happens:

1. Initial access through phishing, stolen VPN or RDP credentials, or an unpatched internet-facing system.
2. Persistence: installing backdoors or remote access tools.
3. Privilege escalation to administrator or domain admin.
4. Lateral movement across the network.
5. Data exfiltration to use as leverage.
6. Destroying backups and disabling security tools.
7. Encryption and the ransom note.

Every stage before encryption is a chance to detect and stop them.

Ten controls that stop most ransomware

1. Patch internet-facing systems fast, especially VPNs, firewalls and email servers.
2. Never expose RDP directly to the internet.
3. Enforce MFA on email, VPN, remote access and all admin accounts.
4. Apply least privilege and separate admin accounts from everyday accounts.
5. Deploy EDR on every endpoint and server, with tamper protection enabled.
6. Segment the network so one infected machine cannot reach everything.
7. Harden email against phishing and block risky attachment types.
8. Restrict macros and scripting tools for ordinary users.
9. Monitor centrally with a SIEM, and alert on new admin accounts, disabled security tools and mass file changes.
10. Test your defences with regular penetration testing.

Backups: the 3-2-1-1-0 rule

Keep 3 copies of your data, on 2 different types of media, with 1 copy off-site, 1 copy offline or immutable (so attackers cannot delete or encrypt it), and 0 errors when you test restores. Backups that have never been restored are hopes, not backups.

Early warning signs

• New administrator accounts or unexpected group membership changes.
• Security tools being disabled or uninstalled.
• Use of tools like PsExec, network scanners or remote access software where they are not normally used.
• Large outbound data transfers, especially to cloud storage.
• Deletion of shadow copies or backup jobs.

What to do if you are hit

1. Isolate affected systems from the network, but do not power them off.
2. Activate your incident response plan and bring in experienced responders.
3. Preserve evidence: logs, ransom notes and affected machines.
4. Identify the entry point before restoring, or the attackers will simply return.
5. Restore from clean, tested backups and reset all credentials.
6. Meet your legal and regulatory obligations for notification.

Paying the ransom does not guarantee you will get your data back or that stolen data will be deleted, and it funds the next attack. Some payments may also create legal or sanctions risks. Make the decision with legal counsel, never in panic.

My incident response guide explains how to prepare in detail. For a ransomware readiness assessment, contact me.

References and further reading

1. CISA #StopRansomware
2. UK NCSC: Mitigating malware and ransomware attacks
3. MITRE ATT&CK T1486: Data Encrypted for Impact
4. CISA Known Exploited Vulnerabilities Catalog