preventing ransomware in a small business.

Ransomware is not a big-company problem. Small businesses get hit constantly, precisely because attackers assume, usually correctly, that a twelve-person company has no security team, no tested backups, and a strong incentive to pay quietly. The good news is that most attacks on small businesses are not sophisticated. A handful of controls, applied consistently, stops the large majority of them.

Here is how these attacks actually start, and the defenses we would put in place first, in order.

how it actually gets in

Ransomware rarely breaks in through some exotic flaw. It walks in through one of three doors:

• A phishing email that convinces someone to open an attachment or type their password into a fake login page.
• A stolen or guessed password on something reachable from the internet, like email, remote desktop, or a VPN with no second factor.
• Unpatched software, an old server, a firewall that has not seen an update in years, a forgotten remote access tool.

Every defense below maps to one of those three doors. If a security product does not clearly close one of them, it is not where your first dollars should go.

backups are the difference between an incident and a disaster

Whether ransomware is a terrible week or the end of the business usually comes down to backups. Attackers know this, so modern ransomware hunts for backups and encrypts or deletes them first. A backup your server can reach and overwrite is a backup the attacker can reach too.

What good looks like:

• At least one copy offsite or in a cloud service, separate from your network credentials.
• A copy that is immutable or offline, meaning it cannot be changed or deleted even with an administrator password.
• A restore test on the calendar. Actually restore a server or a folder every quarter and time it.

MFA on everything that faces the internet

Multi-factor authentication, the code or prompt on your phone after you enter a password, is the single cheapest defense that exists. It turns a stolen password from a catastrophe into a nuisance. Turn it on for email first, then for remote access, banking, payroll, and any administrator account. If a vendor cannot offer MFA on something exposed to the internet, that is a reason to replace the vendor.

email protection and patching

Since most attacks arrive by email, put a real filtering layer in front of your inboxes. Microsoft 365 and Google Workspace both include solid protection, but the stronger settings are often not on by default. Enable link checking and attachment scanning, and flag external senders so a spoofed “internal” email stands out.

Then close the third door: updates. Turn on automatic updates for Windows and browsers, and put a monthly reminder on the calendar for the things that do not update themselves, firewalls, servers, and any industry-specific software. Retire anything the vendor no longer supports. An unsupported operating system on the network is an open window that never closes.

endpoint protection, not just antivirus

Traditional antivirus checks files against a list of known bad ones. Modern endpoint protection, often called EDR, watches for ransomware-like behavior, files being encrypted in bulk, backup services being shut off, and can isolate a machine automatically. For a small business the cost difference is modest and the difference in outcome is large: one isolated laptop instead of every machine in the building.

train people, briefly and often

One annual security lecture accomplishes nothing. Short and frequent works: five minutes in a staff meeting on what current phishing emails look like, an occasional simulated phish, and one clear rule repeated until it is boring. Anyone who clicked something suspicious should report it immediately and will never be punished for reporting. Speed of reporting matters more than the click itself, and a fear culture buys attackers hours of free time.

if you get hit anyway

• Disconnect affected machines from the network. Unplug the cable or kill the Wi-Fi. Do not power them off; that can destroy evidence needed for recovery.
• Call for help before touching anything else: your IT partner, your cyber insurance carrier if you have one, and in the US, the FBI’s IC3 for reporting.
• Do not pay quickly or alone. Payment is a last resort with legal implications, and decryption tools for some strains already exist for free.
• Assume passwords are stolen. Reset credentials, starting with administrators and email.
• Restore from the backups you tested, oldest doors patched first.

where we fit

None of this requires an enterprise budget. It requires doing the basics deliberately and checking them on a schedule. We run exactly these controls for small businesses, from assessments to monitored backups and endpoint protection. Our cybersecurity services page covers what that looks like in practice.