How to protect a small business from ransomware

How attacks on small offices usually start

Very few ransomware incidents in small businesses begin with a clever zero-day exploit. The usual entry points are a password reused from a breached website, a remote desktop port left open on the internet, an unpatched firewall or VPN appliance, or a staff member who opens an attachment and enables content. Attackers buy access to thousands of these weak doors at once and then pick the ones that look worth the effort. Once inside, they rarely encrypt straight away. They spend days or weeks looking around: finding the file server, the backup system and any account with administrator rights. That quiet period is your best chance to catch them, and it is why detection matters as much as prevention.

Backups the attacker cannot touch

Modern ransomware groups go after backups first, because a business that can restore will not pay. A USB drive that stays plugged into the server, or a backup share mapped with the same admin account, gets encrypted along with everything else. What you need is at least one copy that is offline, immutable or held by a separate cloud service with its own credentials.

Immutable storage means the backup cannot be changed or deleted for a set number of days, even by an administrator. Pair that with a test restore every quarter, timed, so you know whether getting the business back means hours or a week. A backup nobody has restored is a hope, not a plan.

Close the common doors

Turn on multi-factor sign-in for Microsoft 365, the VPN, remote access tools, your accounting software and anything else reachable from the internet. Remove remote desktop from direct internet exposure entirely; put it behind a VPN or a gateway that requires MFA. Check your firewall's management page is not open to the world.

Patching matters most on the things facing outward: the firewall, VPN, email server if you still run one, and any remote access software. Vulnerabilities in these devices are scanned for within days of being announced. Desktops and laptops should take Windows and browser updates within a couple of weeks, with critical fixes sooner.

Take away the keys attackers want

If staff log in every day with administrator rights, any malware they run also has those rights. Give people standard accounts and keep admin accounts separate, used only when needed, with MFA. The same applies to the server: a single shared admin password that everyone in the office knows is exactly what an intruder hopes to find. Domain admin and global admin accounts deserve extra care. Keep them few, name them clearly, never use them for email or browsing, and review who holds them every few months. When someone leaves, their privileged access should go the same afternoon.

Detection that can act, not just alert

Traditional antivirus looks for known bad files. Ransomware operators increasingly use legitimate tools already on the computer, so a signature scan sees nothing wrong. Endpoint detection and response watches behaviour instead: a process suddenly renaming thousands of files, credential dumping, or unusual remote commands. Good EDR can isolate a laptop from the network automatically. Detection only helps if someone sees the alert. For a small office without an IT person, that means a provider or a managed service watching the console and acting on what it raises, with a clear rule for what gets isolated without waiting for permission.

Prepare for the day it still happens

No set of controls is perfect, so write down what you would do. Who decides to disconnect the internet? Who calls the insurer, and what is the policy number? Where is the offline list of staff and supplier contacts if email is down? A one-page plan agreed in advance saves hours of confusion at the worst moment. If you want a second opinion on where your gaps are, an Office IT health check walks through each of these controls and ranks what to fix first.

Train people for the moment that matters

Technology carries most of the load, but staff still decide whether to open the strange attachment, approve the unexpected sign-in prompt or report the odd pop-up. Short, regular training works better than a yearly slideshow. Focus on three habits: pause before enabling macros or content in a document someone sent you, never approve an MFA request you did not start, and tell someone straight away if something looks wrong, even if you already clicked. A culture where people report mistakes quickly, without being blamed, gives you hours of warning that you would otherwise lose.

Make reporting easy. One email address or one named person, known to everyone, is enough. Thank people who raise false alarms; the alternative is staff who stay quiet because they worry about looking silly, and a quiet intruder who has another week to explore your network. Fast, blame-free reporting is one of the cheapest controls a small business can have.