Ransomware is no longer just a big-company problem. Mid-sized manufacturers, distributors, hospitals and schools are frequent targets, because they hold valuable data and often lack a dedicated security team.
The good news: most attacks use the same few entry points. Close them and you stop the majority.
The checklist
- Turn on multi-factor authentication for email, VPN, remote desktop and every admin account.
- Never expose Remote Desktop (RDP) directly to the internet; put it behind a VPN or zero-trust access.
- Patch operating systems, firewalls and VPN appliances monthly, and critical fixes within days.
- Remove local admin rights from everyday user accounts.
- Use endpoint detection and response (EDR), not just traditional antivirus.
- Filter email for malicious attachments and links, and train staff to report phishing.
- Segment the network so one infected PC cannot reach servers and backups.
- Follow the 3-2-1-1-0 backup rule (below).
- Keep central logs so you can see what happened, and keep them long enough to investigate.
- Write and rehearse an incident response plan, including who calls whom.
If the worst happens
- Disconnect affected machines from the network, but do not switch them off; memory can hold evidence.
- Activate your incident plan and bring in experienced responders.
- Report to CERT-In within six hours of noticing the incident, as its 2022 directions require for reportable incidents.
- If personal data is affected, plan for DPDP breach notification as well.
- Restore from clean backups after the entry point is closed, not before.
How attackers usually get in
| Entry point | Why it works | The fix |
|---|---|---|
| Phishing email | One click installs malware or steals a password | Email filtering, MFA, staff reporting habit |
| Exposed remote desktop | Weak or reused passwords are guessed automatically | VPN or zero-trust access, MFA, lockout |
| Unpatched VPN or firewall | Known vulnerabilities are exploited within days of disclosure | Fast patching of internet-facing devices |
| Stolen credentials | Passwords reused from other breached sites | MFA everywhere, password manager |
| Compromised vendor access | IT or software vendors with standing remote access | Time-limited, monitored vendor accounts |
Where to start if budget is tight
If you can only do three things this quarter, do these: turn on MFA for email and remote access, get one backup copy offline or immutable and test a restore, and patch everything that faces the internet. Together they block or neutralise most real-world ransomware attacks on small and mid-sized businesses.
The cheapest ransomware recovery is the one where you restore yesterday's backup and carry on.
