Ransomware is malicious software that encrypts the files on a computer or an entire network and demands payment to give them back. In recent years many gangs have added a second threat: before encrypting, they copy the data and threaten to publish it. For a small business, a professional practice or a shop with three computers, the effect is the same as a fire: work stops.
People often assume criminals only go after large companies. In reality many attacks are opportunistic: attackers look for vulnerable systems, not famous names. A small organisation with an exposed server and no backups is an easy target.
How ransomware gets in
Knowing the entry points helps you decide where to put your defences. The most common are:
- Emails with malicious attachments or links: a fake invoice, a fake delivery notice, a document "to sign".
- Exposed remote access: remote desktop or management panels reachable from the internet with weak or reused passwords.
- Outdated software: VPNs, firewalls, mail servers or business applications with known, unpatched vulnerabilities.
- Stolen credentials: passwords leaked from other services and reused for the business account.
- Programs downloaded from unofficial sources: "cracked" versions of paid software are a classic carrier.
Once inside, attackers rarely encrypt straight away. They often explore the network, look for backups to delete and obtain administrator privileges. Only then do they launch the encryption, perhaps at night or over a weekend.
The defences that matter most
Separate, verified backups
This is defence number one, because it turns a disaster into an inconvenience. But a backup on a disk that is always connected, or on a network share the infected computer can reach, will be encrypted along with everything else. You need at least one offline or immutable copy (one that cannot be changed for a set period), and you need to test restoring it regularly. An untested backup is a hope, not a guarantee.
Prompt updates
Operating systems, browsers, VPNs, routers and business software should be updated regularly. Devices exposed to the internet, such as firewalls and VPNs, come first: when a security fix is released for them, it is worth applying it within a few days.
No unprotected exposed services
Remote desktop opened directly to the internet is a door left ajar. If you need to work from outside, use an up-to-date VPN with two-factor authentication, or a remote access solution that requires a second factor.
Two-factor authentication wherever possible
Email, VPN, admin panels, cloud services: a second factor makes a stolen password useless in most cases.
Least privilege
Whoever uses a computer every day shouldn't do so with an administrator account. If ransomware starts from a standard account, it has far less room to do damage. Administrative accounts should be used only when needed and protected with unique passwords and a second factor.
Endpoint protection
A good modern antivirus, or better an endpoint protection solution with behavioural analysis, can stop mass encryption when it recognises it. It isn't infallible, but it is one more layer.
A realistic example
A practice with five workstations uses an old server for shared files. To work from home, the owner opened remote desktop on the router. One night someone tries thousands of passwords, finds the right one, gets in, deletes the backup copies stored on the same server and encrypts everything. On Monday morning nobody can open a single document. With a VPN, a second factor and a weekly offline backup, the same scenario would have ended with a day spent restoring.
Preparing for the worst day
Even with good defences, it pays to have a one-page written plan:
- Who to call: your technician or IT provider, with the phone number written on paper.
- What to disconnect: affected computers should be isolated from the network, without hastily switching them off if a technician can examine them.
- Where the backups are and how to restore them, with the credentials kept outside the company systems.
- How to keep working: which tasks can continue on paper or from clean devices.
- Who to inform: customers, suppliers, and the authorities when personal data or crimes are involved.
Should you pay the ransom?
Paying doesn't guarantee you'll get your data back, nor that stolen data will be deleted, and it funds the attackers. Those with working backups usually don't even face the question: that is precisely the point of prevention.
In short
- Ransomware hits small organisations too, often opportunistically.
- Typical entry points are email, exposed remote access, old software and reused passwords.
- An offline or immutable backup, regularly tested, is the most important defence.
- Updates, a second factor and non-admin accounts drastically reduce the risk.
- A written response plan saves precious hours when something goes wrong.