Ransomware: how to protect your business

Ransomware is malicious software that encrypts a company’s files and demands a ransom to unlock them. Often the attackers also threaten to publish the stolen data. The result is stalled operations, lost data and major reputational harm. The key thing to know: ransomware most often gets into a business not through a sophisticated break-in, but through a simple phishing email.

How ransomware gets into a business

• checkA phishing email with a malicious attachment (e.g. an Office document with macros or a .zip file).
• checkA link to a page that downloads malicious software.
• checkStolen login details, through which the attacker logs in and starts the encryption.
• checkUnpatched software with known vulnerabilities.

How to protect yourself: prevention

Since most attacks start with a human, prevention relies on both technology and alertness.

• checkTrain employees to spot phishing — this is the first line of defence.
• checkEnable 2FA, so a stolen password does not open the door.
• checkRegularly update systems and software to close known vulnerabilities.
• checkLimit access rights — an employee sees only what the job requires.
• checkBlock dangerous attachments and macros where they are not needed.

Backups — the most important defence

If your data is encrypted, a reliable backup lets you recover without paying. But a backup is only useful when it actually works. Follow the 3-2-1 principle: three copies, on two different media, one of them kept off the network. And most importantly — periodically verify that you can actually restore data from the backup.

What to do when an attack happens

• checkIsolate affected devices — disconnect them from the network so the encryption does not spread.
• checkDo not pay the ransom immediately — it gives no guarantees and encourages new attacks.
• checkInform management and IT, and document what happened and when.
• checkRestore data from reliable backups.
• checkAssess whether you need to inform customers and responsible authorities about the data.

Where the weakest link is

Technical measures are essential, but ransomware is most often let in by a person who opened the wrong attachment or entered a password on a fake page. So resilience starts with a trained team. Safe phishing simulations show who actually opens dangerous attachments, and short training right after a mistake turns risk into a skill — which is exactly what Opsinel automates.