Protecting an SMB against ransomware

How an attack unfolds

Ransomware almost always follows the same script: an initial access (often a booby-trapped email or a stolen credential), a quiet spreading phase across the network, then the mass encryption of files and the ransom demand. Understanding this chain helps place the right defences at the right points.

The goal is not to build an impenetrable fortress, which does not exist, but to break the chain at several links: prevent entry, limit spread, and guarantee recovery even if the attack succeeds.

Detect and isolate: EDR

Traditional antivirus recognizes known threats. Against today's attacks, that is not enough. An EDR (Endpoint Detection and Response) watches for suspicious behaviour on workstations and servers, and can automatically isolate a compromised machine before the infection spreads.

It is now the first technical link in a serious defence. Our cybersecurity page details how EDR fits into continuous monitoring, because an unsupervised tool is useless when the alert fires at 3 a.m.

Immutable and offline backups

Modern ransomware actively hunts your backups to encrypt them too. If your only copies are accessible online, you risk losing everything. The countermeasure: immutable backups, impossible to modify or delete for a defined period, and at least one offline or off-site copy.

A well-applied 3-2-1 strategy lets you restore without ever paying. It is the best reason not to give in to extortion: if you can rebuild everything, the ransom loses its power.

Segment the network to limit the damage

A flat network, where every machine can talk to every other, is an ideal playground for ransomware. Segmentation carves the network into watertight zones: an infected workstation in one department cannot reach the critical servers of another.

This measure does not prevent intrusion, but it drastically reduces its scope. Instead of losing everything, you lose at worst one zone, which you can isolate and restore while the rest keeps running.

Close the front door: MFA and least privilege

Most intrusions exploit stolen or reused credentials. Multi-factor authentication (MFA) blocks the bulk of these attacks: even with your password, the attacker lacks the second factor.

The principle of least privilege completes the defence: each account accesses only what it strictly needs. That way, a compromised account does not hand over the keys to the whole kingdom. These two measures cost little and pay off enormously.

Recognize the warning signs

A ransomware attack is rarely instantaneous. Between the initial intrusion and final encryption, days or even weeks often pass while the attacker explores the network. Weak signals exist: unusual logins outside hours, accounts being created, admin tools used abnormally.

Spotting these signs requires active monitoring. That is precisely the role of an EDR coupled with human supervision: turning isolated anomalies into an actionable alert before encryption is triggered.

Many SMBs, lacking monitoring, only discover the intrusion at the ransom demand. Detecting early often means being able to stop the attack while it has destroyed nothing yet.

The most common entry points

Three doors dominate. The phishing email is number one: a booby-trapped attachment or a link to a fake site that steals credentials. Next comes the exploitation of internet-facing services that are not up to date, such as a poorly protected remote access.

The third vector is the stolen or reused credential, bought on underground markets or recovered from a leak. This is why MFA is so effective: it neutralizes this major access route.

Knowing these vectors guides priorities: filter email, close or protect exposed services, and generalize strong authentication. You shut the most-used doors rather than scattering your effort.

What to do in the first hours

The immediate reaction shapes the extent of the damage. The first reflex is to isolate: disconnect affected machines from the network to stop the spread, without turning them off, so as to preserve traces useful for analysis.

You then alert the right people according to a predefined plan, assess the extent of the compromise, and preserve clean backups by checking they have not been hit. Disorderly haste often makes the situation worse.

This is where lack of preparation costs you. A business that has rehearsed its recovery plan acts methodically; another improvises and loses precious time while encryption advances.

Train people and test your resilience

Technology stops a lot, but people remain the prime target. Regular, short, concrete awareness training markedly reduces the risk, provided it avoids blame: an employee who fears punishment hides their mistake instead of reporting it, and speed of reporting often decides the outcome.

You only discover the strength of your defences by testing them. Regular exercises, from a backup restore test to a full attack simulation, reveal gaps before an attacker exploits them. It is uncomfortable, but far cheaper than a real, mishandled crisis.

For an SMB, there is no need for complex drills at first. Starting with a full restore test once a year, then adding scenarios, builds a discipline that pays off the day a real incident strikes.

Phishing simulations as a training tool

Awareness sessions fade quickly; practice sticks. Controlled phishing simulations, used as a teaching tool rather than a punitive trap, let staff experience a realistic attempt in safe conditions and learn to spot the tells. Repeated occasionally, they turn abstract advice into reflexes.

The key is tone. Simulations must build a culture where reporting a suspicious click is valued, not where people fear being shamed. The metric that matters is how fast a real attempt is flagged, because speed of reporting often decides whether an intrusion is contained or spreads.

Pair simulations with a simple, blame-free reporting channel. An employee who can raise the alarm in one click, without dreading the consequences, becomes part of your defence rather than a hidden liability. People, properly supported, are a sensor network no tool can replace.

Why SMBs are prime targets

Attackers favour SMBs for a simple reason: they often combine valuable data with limited defences. Lacking the security teams of large firms, many run unpatched systems, weak passwords and untested backups, which makes them quick, profitable victims rather than hard targets.

Automation makes it worse. Most attacks are not hand-picked; they sweep the internet for known weaknesses and strike whatever responds. An SMB does not need to be famous to be hit, only reachable and vulnerable, which puts it squarely in the line of fire.

The good news is that the same automation that finds easy victims also passes over well-defended ones. Closing the obvious gaps, MFA, patching, immutable backups, moves you out of the easy-prey category, which deters the bulk of opportunistic attacks.

Recovering without paying the ransom

The whole point of a ransom is leverage: the attacker bets you cannot recover on your own. Remove that bet and the leverage collapses. Clean, immutable, tested backups let you rebuild from a known-good state instead of negotiating with criminals.

Paying is discouraged by authorities for sound reasons: it funds further attacks, marks you as a willing payer, and offers no guarantee. Decryption keys provided after payment are often slow or partial, and the intrusion that let the attack in usually remains.

A rehearsed recovery turns a potential catastrophe into a manageable outage. The businesses that bounce back fastest are not the luckiest, but the ones that prepared: isolated copies, a clear restore order, and a team that has practised the drill.

Email and endpoint hygiene

Since most attacks arrive by email, filtering matters. Modern email security blocks malicious attachments and links before they reach inboxes, sharply reducing the chance of a harmful click. It is a quiet but high-impact layer that many SMBs underuse.

On the endpoint side, keeping systems and browsers patched closes the doors attackers rely on. Pairing this with EDR means that even if something slips through, suspicious behaviour is caught and the machine isolated before the infection spreads.

None of this is exotic. Email filtering, patching and EDR are mature, affordable measures, especially when bundled into a managed service that keeps them running and watches the alerts they generate around the clock.

Cyber insurance: a complement, not a substitute

More and more businesses take out cyber insurance. It is a useful safety net to absorb part of an incident's cost, but it is not protection: a policy replaces neither EDR, nor backups, nor MFA.

In fact, insurers now require a minimum security baseline to grant or maintain coverage. Without MFA, tested backups and a response plan, the premium climbs or the guarantee is refused. Technical security therefore conditions insurability.

Seen this way, cyber insurance and technical measures are complementary. The latter reduce the probability and impact of an attack; the former cushions what remains. One never excuses the absence of the other.

FAQ