Preventing Ransomware in Your Company: Practical Measures That Actually Work

For a company, ransomware is not just a “virus”; it means a complete halt to work. The accounting server is locked, files will not open, invoicing and payroll stop, and sometimes customer data has already left the network before encryption. The good news is that most attacks come in through a few familiar routes, and relatively simple measures can block a large share of them.

How Does Ransomware Work?

Modern attacks usually have several stages, and encrypting files is the last one:

1. Entry: Through Remote Desktop exposed to the internet, a leaked VPN or email password, an infected attachment, or an unpatched vulnerability in the firewall or servers.
2. Spread: By stealing passwords, the attacker escalates access up to admin accounts and the main servers.
3. Disabling backups: Reachable backups are deleted or encrypted so there is no way back.
4. Theft and encryption: Data is exfiltrated, then files and virtual machines are encrypted.

Every preventive measure should make at least one of these stages harder.

Close the Entry Points

• Do not leave Remote Desktop exposed directly to the internet. Remote access should only go through a VPN or a secure gateway.
• Enable two-factor authentication for VPN, email and every panel reachable from the internet.
• Update edge devices first: Vulnerabilities in firewalls, VPNs and internet-facing servers are among attackers’ main targets.
• Filter dangerous attachments: Block executables and password-protected archives in email, and keep macros in Office files received from the internet disabled with Group Policy.

Stop It from Spreading Across the Network

If an attacker gets into one computer, they should not be able to reach everything easily:

• Regular users should not have admin rights on their computers.
• The local admin password on each computer should be unique; Windows LAPS does this automatically.
• Domain Admin accounts should be limited and used only on servers and domain controllers, not on user computers.
• Segment the network so user computers can only reach the server ports they need.
• Block file sharing between user computers with Windows Firewall; computers usually have no need to connect to each other’s SMB port.
• Disable the legacy SMBv1 protocol on all systems.

Keep Backups Out of Reach

The attacker’s goal is to leave you no option but to pay. At least one backup copy should be immutable or offline, the backup server should not be joined to the domain and should have its own separate password. Test restores regularly as well; a backup whose restore has never been tested cannot be relied on in a crisis.

Backups are the only way out after encryption, but if data was stolen beforehand, backups cannot undo that part of the damage. That is why you need both prevention and backups.

Spot the Signs Early

Most attacks show signs days or even weeks before encryption: repeated failed logins, a new admin account being created, admin tools running at unusual hours, or antivirus being disabled. A protection tool with EDR capabilities, plus regular review of alerts and logs, gives you a chance to stop the attack before its final stage.

Common Mistakes

• Relying on antivirus alone and ignoring access rights and updates
• Backups on a NAS that is reachable with the same domain accounts
• A shared admin account with a fixed password known to every technician and contractor
• No staff training on spotting fake emails

Checklist

• No RDP or management panel is exposed directly to the internet.
• VPN and email have two-factor authentication.
• The firewall, VPN and servers are up to date.
• Users have no local admin rights and local admin passwords are unique.
• At least one offline or immutable backup copy exists, and restores have been tested.
• Security alerts are reviewed every day.
• Staff have been trained on phishing emails.

ITPlus724 engineers can assess your network against these points and fix weaknesses in order of priority.