Ransomware encrypts or steals data, then demands payment for recovery or non-disclosure. Antivirus matters, but addresses only part of the problem. Attacks rarely begin and end on one computer.
An attack is a process
Attackers first gain access through stolen credentials, exposed vulnerable services or phishing. They explore the network, escalate privileges and find backups and valuable data. Encryption often comes last.
Defence needs complementary layers: if one fails, others can slow, detect or contain the attack. CISA's #StopRansomware Guide combines offline backups, segmentation, MFA, updates and prepared response.
Backups that survive the attack
Backups must withstand an attacker with administrator access.
The common 3-2-1 principle uses three data copies on two storage types, with one off site. Ransomware defence also needs a copy attackers cannot alter or delete through the normal network: offline media or immutable storage with protected retention.
- Separate backup access from ordinary domain accounts.
- Protect backup administration with MFA.
- Monitor unusual deletion and retention changes.
- Test restoration regularly, beyond checking backup completion.
- Measure critical system recovery time and define recovery order.
For cloud services, verify exactly what the provider backs up, retention and restoration. Synchronisation is not backup: encrypted or deleted files may propagate to every device.
An untested backup is an assumption rather than assurance.
Segmentation and identities
After one computer is compromised, a flat network makes further movement easier.
Separate users, servers, administration, backups and operational technology with clear communication rules. You can start by limiting remote administration and file sharing to genuine requirements.
Identities matter just as much: valid stolen credentials can enable access without exploiting software.
- Use MFA for email, VPN, remote access and administration.
- Separate administrative and everyday accounts.
- Minimise standing administrative privileges.
- Review former employee, supplier and service accounts.
Prioritise updates for internet-facing VPNs, mail servers and remote access tools.
Detection, response and rollback
EDR monitors process behaviour beyond known signatures. It may identify suspicious activity before encryption and enable device isolation.
Some vendors offer reversal of malicious changes. SentinelOne describes rollback on its website. Its FAQ explains that this uses Windows Volume Shadow Copy Service (VSS). Availability depends on licensing, supported OS, policies and device state, which we verify for each proposal against current vendor terms.
Rollback does not replace backups. It cannot cover devices without agents or recover data already stolen. It is an additional protection layer.
Technology also needs decision-makers. Define who assesses alerts, approves server isolation or disconnects network segments. Response plans need contacts, authority and communication procedures that work even when email and the normal network fail.
APPSEC supplies, deploys and supports SentinelOne for enterprise environments and Heimdal Security for smaller and medium-sized businesses. Technology selection should follow your environment and risks.
Ransomware resilience checklist
- At least one backup copy is offline or immutable.
- Critical system recovery has recently been tested.
- Backup administration uses separate accounts and MFA.
- Email and remote access require MFA.
- Administrative accounts are separate from everyday work.
- Network segmentation separates users, servers, administration and backups.
- Endpoint behavioural detection has assigned alert assessment.
- Licence capabilities and supported platforms are verified.
- A written response plan defines contacts and decision authority.
We can review backups, access and protection technologies to identify useful next steps. Start with a consultation.
