Ransomware against small businesses is not usually the targeted operation the news describes. It is opportunistic, automated at the early stages and it succeeds through unremarkable weaknesses.
Which is encouraging, because unremarkable weaknesses are the kind you can close.
How it actually gets in
Three routes account for the overwhelming majority of small business incidents.
Phishing. Someone enters credentials into a convincing fake sign-in page, or approves a multi-factor prompt they did not initiate. The attacker now has legitimate access and does not need to break anything.
Exposed remote access. Remote desktop published to the internet, a VPN with no second factor, a management interface reachable from anywhere. Automated scanning finds these within hours of them appearing, and credential stuffing does the rest.
Unpatched internet-facing systems. A firewall, a VPN appliance or a web application with a known vulnerability that was published and not applied. Exploitation typically begins within days of disclosure.
Notice what is not on that list. Sophisticated zero-day exploits are a very small minority of what happens to businesses of this size.
What prevention actually consists of
In order of effectiveness per pound.
Multi-factor authentication everywhere
Including administrators, shared accounts and service accounts. This single control removes the value of a stolen password, which is the commonest entry route.
Use an authenticator app with number matching rather than SMS. Number matching specifically defeats prompt-bombing, where an attacker triggers repeated approval requests until somebody taps accept to make it stop.
Take remote access off the internet
Remote desktop should never be directly exposed. Use a VPN with multi-factor authentication, or a modern zero-trust access service. If you are unsure whether anything is exposed, find out today — that is a scan, not a project.
Patch within fourteen days
Everything, including firmware on firewalls and VPN appliances. Those appliances are the most attractive target precisely because they sit at the boundary and are frequently forgotten.
Remove standing administrative privilege
Nobody should work day to day from an administrator account. Ransomware inherits the privileges of the account that runs it, and an infection from a standard user account is a bad day rather than a catastrophe.
Backups that ransomware cannot reach
The control that determines whether an incident is a disruption or an extinction event. Covered fully in backups that actually restore, and the essential points are that at least one copy must be immutable or offline, and that backups must be outside the domain and the tenancy the attacker has compromised.
Attackers find and destroy backups before they encrypt anything. A backup reachable with the credentials they have already stolen is not a backup.
Detection: the days before encryption
Encryption is the last step, not the first. Attackers are typically inside for days or weeks beforehand, exploring, escalating privilege and locating backups.
That period is your opportunity. Signals worth alerting on:
- Sign-ins from unexpected countries or at unusual hours
- New administrator accounts, or existing accounts gaining privilege
- Security tools being disabled or excluded
- Large volumes of files being accessed, renamed or deleted
- Backup jobs failing or being modified
- Unusual outbound data volumes, which indicates exfiltration before encryption
Most of these are available in Microsoft 365 and in Defender for Business, and most businesses have never configured an alert on any of them. Setting them up is an afternoon.
The first two hours
Written down in advance, because nobody thinks clearly at this point.
- Disconnect, do not power off. Pull affected machines off the network. Powering off destroys memory evidence that helps establish what happened and what was taken.
- Assume credentials are compromised. Reset passwords and revoke sessions for administrative accounts from a machine you know is clean.
- Protect the backups. Isolate them immediately. This is the first thing an attacker goes for and the last thing you can afford to lose.
- Call your IT support and your insurer. Cyber insurance policies frequently require notification within a specified window and may mandate the use of their incident response provider — using your own first can affect cover.
- Report it. Action Fraud and the NCSC. If personal data is involved, the ICO must be notified within 72 hours of becoming aware.
- Do not restore anything yet. Restoring into a compromised environment reinfects immediately. Establish scope first.
On paying
UK law enforcement advises against it. Beyond the principle, three practical points: payment does not reliably produce a working decryption key, it identifies you as a business that pays and depending on who is behind the attack it may raise sanctions issues.
The decision is far easier when you have tested backups, which is the honest reason to invest in them.
What to do this week
- Check nothing is exposed. Remote desktop, management interfaces, anything reachable from the internet.
- Confirm multi-factor authentication has no exceptions.
- Verify at least one backup copy is immutable or offline, and test a restore.
- Turn on the detection alerts listed above.
- Write the first two hours down and put it somewhere reachable when systems are down — printed, not only in SharePoint.
That last detail catches people out. A response plan that only exists inside the systems that have been encrypted is not a plan.
Our security solutions team works with UK businesses on both halves of this: closing the routes in, and being ready if something gets through anyway. Get in touch for an honest assessment of where you currently stand.
