Ransomware — how to protect your company effectively

What an attack really looks like

Modern ransomware is a process, not a single click. The typical chain: entry (phishing, a stolen password without MFA, an unpatched system) → quiet reconnaissance (days, sometimes weeks of moving through the network and escalating privileges) → data theft (files exfiltrated before encryption) → encryption at the least convenient moment, often on a Friday night. The key insight: a lot of time usually passes between entry and encryption — well-configured monitoring detects the attack at the reconnaissance stage, before anything gets encrypted.

Five layers of protection — in order of cost-effectiveness

1. MFA on all accounts — no exceptions for management (those are the most attacked accounts). The best effect-to-cost ratio in all of cybersecurity; it cuts off most attacks based on stolen passwords.
2. EDR instead of classic antivirus — it detects behaviour (mass file encryption, suspicious lateral movement), not just known signatures. It's EDR that catches an attack at the reconnaissance stage.
3. Disciplined patching — critical patches for systems and edge devices (firewall, VPN) within 14 days of release. A large share of breaches exploit holes patched many months earlier.
4. Least privilege and segmentation — an employee doesn't need admin rights to work, and accounting doesn't need to "see" the production server. Segmentation turns a fire across the whole network into a fire in one room.
5. Training with phishing simulations — at least quarterly. Not to punish clickers, but to cut the time to report a suspicious e-mail from days to minutes.

The maths is brutally simple: the cost of these five layers for a 30-person company is a fraction of the cost of one successful attack — which includes downtime (on average 2–3 weeks to full recovery), environment rebuild, GDPR legal handling and lost client trust.

Backup — the last line of defence, if built correctly

Modern ransomware looks for backups first, encrypting or deleting them before touching anything else. A backup connected to the same network, on the same NAS, accessible with the same admin accounts — to the attacker it's just another folder. The minimum conditions: copies of your data in several locations, at least one immutable or offline copy, and regular restore tests.

Response plan: the first 24 hours

1. Isolate, don't power off — disconnect infected machines from the network (cable, Wi-Fi), but don't cut power: memory may hold traces and keys useful to investigators.
2. Alert your IT team / provider — immediately, even at night. Every hour of delay means more encrypted assets.
3. Cut off access — reset admin and VPN passwords from a clean device, lock service accounts, terminate sessions.
4. Report the incident — to your national CSIRT (in Poland: CSIRT NASK, incydent.cert.pl) and, where personal data is involved, to the data protection authority within 72 hours. Reporting is a duty — and access to support.
5. Preserve evidence and assess scope — what was encrypted, what may have leaked, which backup is clean. Only then decide on the recovery path.
6. Communicate deliberately — one person responsible for communication with the team, clients and possibly the media; no do-it-yourself negotiations with criminals.

Should you pay the ransom

The short answer: it's a last resort that usually disappoints. Payment guarantees nothing: some companies that pay never recover all their data (decryptors are often faulty), and the stolen data stays in criminal hands anyway. Payers also end up on lists of "clients who pay" — the risk of a repeat attack grows. Add legal risk: a transfer to a sanctioned group can itself be a violation of the law. The only situation in which the topic returns to the table is the absence of any clean copy of data critical to the company's survival — and that is precisely why the whole defence strategy boils down to never ending up in that place.