Ransomware Basics: How a Small Office Can Lower Its Risk

Ransomware is malicious software that scrambles your files so you cannot open them, then demands payment for the key to unlock them. Many groups now also copy data before scrambling it and threaten to publish it if you do not pay. For a small office, an attack can mean days without access to client files, schedules, invoices or email.

You cannot make an office immune. You can make an attack much less likely to succeed and much less damaging if it does. This guide covers how ransomware gets in, the defenses that matter most and a plan for the first hour.

How ransomware usually gets in

Attackers rarely need anything exotic. The common entry points are ordinary:

• Phishing emails with malicious attachments or links to fake login pages.
• Stolen or guessed passwords, especially for email and remote access accounts without two-factor authentication.
• Remote access exposed to the internet, such as a Windows Remote Desktop connection reachable directly from anywhere, which automated tools scan for constantly.
• Unpatched software on internet-facing devices like routers, firewalls and servers.
• A trusted vendor or tool that is itself compromised, passing the problem along.

Once inside, attackers often look around quietly, try to gain administrator access, find the backups and then launch the encryption all at once.

Five defenses that matter most

1. Backups the attacker cannot reach

Backups are your path to recovery without paying. But if the backup drive is always connected or the backup account uses the same password as everything else, ransomware can encrypt or delete it too. Keep at least one copy offline or in a service that keeps protected, unchangeable versions for a period of time. Then actually test restoring files, because an untested backup is a hope, not a plan.

2. Two-factor authentication everywhere it counts

Turn it on for email, cloud storage, remote access, banking and any administrator account. It blocks the large share of attacks that begin with a stolen password. Our comparison of two-factor authentication methods shows which options are strongest.

3. Prompt updates

Install security updates quickly on computers, servers, routers and firewalls. Our software update routine makes this a weekly habit rather than a scramble.

4. Everyday accounts without administrator rights

Staff should do daily work in accounts that cannot install software or change system settings. Keep administrator accounts separate and use them only when needed. This limits how far an infection can spread from a single click.

5. Careful remote access

Do not leave remote desktop services open directly to the internet. Use a tool or gateway designed for remote access, protect it with two-factor authentication and remove access when it is no longer needed. Our guide to remote desktop access explains safer setups.

Training rounds out these defenses. A team that knows how to spot a phishing email and feels safe reporting a mistake gives you early warning.

Signs something is wrong

• Files suddenly have strange extensions or will not open.
• A text file or desktop wallpaper appears demanding payment.
• Computers slow down dramatically or many files change at once.
• Security software reports being disabled.

The first hour: a simple response plan

Write this on paper and keep it where people can find it when computers are not working.

1. Disconnect affected computers from the network. Unplug network cables and turn off Wi-Fi. Do not wipe or reinstall anything yet, since evidence may be needed.
2. Disconnect backup drives that are still attached, to protect them.
3. Call for help. Contact whoever supports your technology and your insurance provider, since some policies include incident response help.
4. Report the attack. In the United States, ransomware can be reported to the FBI's Internet Crime Complaint Center and to the Cybersecurity and Infrastructure Security Agency.
5. Change passwords from a clean device, starting with email and administrator accounts.
6. Talk with an attorney if customer, patient or donor information may be affected, since notification rules can apply.

Should you pay?

Law enforcement agencies generally discourage paying ransoms. Payment does not guarantee you will get working files back or that stolen data will be deleted, and it can encourage further attacks. In some situations payment can also raise legal issues. This is a decision to make with law enforcement, your insurer and an attorney, not alone in a moment of panic. Good backups are what give you the freedom to say no.

Recovering safely

Before restoring from backups, make sure the attacker no longer has access. Otherwise, restored files can be encrypted again. Rebuild or clean affected machines, reset passwords and confirm two-factor authentication is on before bringing everything back online. Then review how the attack started and close that door.

For a broader view of what to put in place, see our small business cybersecurity checklist.

Frequently asked questions

Can Macs and phones get ransomware?

Most ransomware targets Windows computers and servers, but no system is completely immune, and attackers also target cloud accounts and network storage. The same defenses apply to every device.

Does cloud storage protect us from ransomware?

Not automatically. File sync services can copy encrypted files over good ones. Version history or a separate backup service can let you roll back, so check what your service offers and for how long.

How often should we test our backups?

Restore a few files at least every few months, and do a larger test once a year. Also test after any major change to how your office stores data.