Ransomware remains one of the costliest threats to organizations, yet most defenses start with basics you can do right away.
1. Follow the 3-2-1 backup rule
Keep 3 copies on 2 types of media, with at least 1 copy isolated from the network (offline or immutable). Ransomware often encrypts or deletes connected backups too.
2. Enable MFA on every critical account
Especially email, VPN, and admin accounts, since stolen passwords are a common way in. See which kind of MFA to choose in Which MFA Is Safer?
3. Patch internet-facing systems first
Start with VPNs, firewalls, remote access, and web servers. Actively exploited vulnerabilities come before the rest.
4. Limit user privileges
- Regular users should not be local admins
- Separate admin accounts from daily-use accounts
- Segment the network so an attack can't spread everywhere
5. Rehearse your incident response plan
Know in advance who decides, who contacts whom, and how infected systems get isolated. A short yearly drill cuts response time significantly.
Limiting privileges and segmenting the network systematically is part of a broader approach. Read on in What Is Zero Trust, and Where Should You Start?
Faster detection and response depends on the right tooling. See SIEM, SOAR and XDR Compared: Strengths and Limits.
After planning, practice for real with tabletop exercises and simulation. See how to start in Network and Cyber Security Simulators: Types and Uses.
Catching hijacked accounts and privilege escalation early is another side of ransomware defense. Read more in ITDR: Detecting and Responding to Identity Attacks.
For the practical steps behind "segment the network," see Network Segmentation and Micro-segmentation: Start Safely.
Limiting who holds admin rights, and when, reduces what a stolen password can do; see PAM Explained: Controlling Privileged Access.
Phishing-resistant authentication reduces the risk from stolen credentials. Plan it phase by phase in Rolling Out Passkeys in the Enterprise, Step by Step.
Step 1 mentions the 3-2-1 rule. To add a copy attackers cannot delete and to test restores with confidence, read on in The 3-2-1-1-0 Backup Strategy and Immutable Backups.
Detection on endpoints, and someone watching outside working hours, helps you respond to ransomware faster. See EDR vs XDR vs MDR: Differences and How to Choose.
Email phishing is one way attackers steal passwords and deploy malware. For layered protection of the email entry point, see Email Security: Layered Defense Against Phishing and BEC.
Patching internet-facing systems first needs a plan behind it. For how to plan and limit the impact on systems, see Patch Management Best Practice: Fast, Without Outages.
Step 5 mentions rehearsing the response plan. To set recovery time targets with RTO and RPO, with a worked calculation, read on in Ransomware Recovery Plan: RTO, RPO and Rehearsals.
Choosing to patch internet-facing systems and actively exploited vulnerabilities first is part of work that can be run as a program; see A Vulnerability Management Program That Works.
Basic measures lower the chance of an incident, but when one happens the organization needs a plan; see Incident Response Plan Under NIST SP 800-61 Rev. 3.
If a ransomware incident has already happened, preserving evidence properly helps the later investigation; see Digital Forensics Basics: Preserve Evidence Properly.
References and further reading
- CISA #StopRansomware: guidance and resources for preventing and responding to ransomware