Ransomware protection: How to protect your company from ransomware trojans

Ransomware protection encompasses all measures that prevent ransomware from infiltrating a system, limit its spread, and enable an orderly recovery in the event of an attack.

The most important point to remember: There is no such thing as 100% protection. Accepting this leads to the right question – not "How do we prevent every attack?" but "How do we ensure that an attack doesn't cost us our company?"

Because modern attacks do more than just encrypt data. Attackers often move undetected within the network for weeks, stealing data, taking over administrator accounts, and selectively deleting backups before striking. A virus scanner alone is not enough to withstand this.

This article shows how such an attack unfolds, which layers of protection are effective and in what order, why backups are the real insurance – and what needs to be done in the first hours after an infection.

Table of contents

• What makes ransomware different today
• How an attack unfolds: the attack chain
• The four levels of protection at a glance
• Why backups are the real insurance
• Emergency plan: what to do in an emergency
• Should you pay the ransom?
• Checklist for ransomware protection
• Conclusion – Ransomware protection
• FAQ on ransomware protection

What makes ransomware different today

Ransomware is malicious software that encrypts data or locks systems to extort a ransom. In companies, there's almost always a second stage: the data is copied before encryption.

This gives the attacker two points of leverage. Even if you can restore the data cleanly, the threat of publishing internal documents, customer data, or calculations remains. A good backup solves the availability problem — it doesn't solve the confidentiality problem.

This leads to an important implication for planning: prevention and detection don't become less important just because backups exist. The earlier an attack is detected, the less data is compromised.

How an attack unfolds: the attack chain

Ransomware attacks are rarely a single event, but rather a chain reaction. The good news is that each link offers an opportunity to stop the attack.

The crucial factor is the time lag: Weeks often pass between the initial attack and the encryption. During this time, the attack is technically successful but not yet detectable.

There are three most common entry points:

• a phishing email
• a stolen or reused password without two-factor authentication
• an unpatched vulnerability in an externally accessible system – typically a firewall, VPN connection, or remote access point.

The four protection levels at a glance

A viable concept operates on four levels. They build upon each other.

Level 1: Prevent entry

This is where the greatest leverage lies, because this is where the attack chain begins.

• Multi-factor authentication for all accounts, especially for remote access and administrators. A stolen password should not be enough. Details can be found in the article on multi-factor authentication.
• Priority updates for all externally accessible systems. How to manage this systematically is described in the article on patch management.
  
• Email filters that check links and attachments, supplemented by clear reporting channels. See phishing protection.
  
• Limit remote access: Remote maintenance services should never be exposed to the internet without protection.

Level 2: early detection

Since attackers can remain online for weeks, the detection time determines the extent of the damage.

Modern endpoint protection detects suspicious behavior, not just known malware—unusual scripts, unauthorized access to login credentials, mass file modifications — and can automatically disconnect a device from the network. The article on endpoint security explains why traditional antivirus software is no longer sufficient.

Equally important: Someone actually has to see the warnings. An alert system whose messages end up in an unread inbox is practically nonexistent.

Level 3: Limit spread

This level determines whether an infected notebook remains an incident or results in a total system failure.

• Minimal access rights: No one works with administrator privileges in their daily tasks. Administrator accounts are separate, dedicated accounts.
  
• Network segmentation: Servers, workstations, guest access, and — if applicable — production facilities should be located in separate network segments.
• Access on demand: Not everyone needs access to every drive. This access level determines how much data a compromised account can encrypt.

Level 4: able to restore

The last layer is the only one that remains effective even when everything else has failed. It is therefore not a fallback position, but the foundation.

For SMEs without their own IT department, the difficulty usually lies not in selecting individual measures, but in operating them continuously and keeping them up-to-date. FIGULI CONSULTING builds these protective layers for Austrian companies, monitors them during operation, and regularly verifies that recovery is actually working.

Review your protection concept with FIGULI



Which ransomware protection measures are a priority for SMEs?

For SMEs, it's crucial not to start with too many individual measures at once. A clear order based on risk and impact is advisable:

1. Activate multi-factor authentication for administrators, Microsoft 365, and remote access
2. Pattern externally accessible systems such as firewalls, VPNs, and remote maintenance systems as a priority
3. Set up email protection and clear reporting channels for suspicious messages
4. Implement modern endpoint protection with behavioral detection
5. Consistently reduce administrator privileges in daily operations
6. Set up immutable backups with separate authentication and sufficient retention time
7. Test recovery and disaster recovery plans at least annually

This order helps to quickly mitigate the greatest risks without overwhelming the company with an overly large security project.

The four protection levels at a glance

All preventative measures reduce the likelihood of an attack. Only a backup determines the consequences.

That's why attackers specifically target backups. They search for accessible backup drives, connected network storage, and backup servers—and delete or encrypt them before encrypting the rest. A backup accessible with the same credentials as the production system is worthless at that moment.

Three characteristics make all the difference:

• Immutability. Once created, backups cannot be deleted or modified for a defined period—not even with administrator privileges. This is the most effective single measure because it remains effective even if the entire environment is compromised.
  
• Separation. The backup account is a separate account with two-factor authentication, not the administrator account used for daily operations. At least one copy is stored off-site.
  
• Sufficient retention period. If the attack is discovered after three weeks, backups from the last seven days are useless—they already contain the malware. The retention period must cover the realistic time until detection.

How to practically implement off-site backups is discussed in the article on cloud backup.

And the point where things most often fail in practice: The recovery process must be tested. In a crisis, the crucial question isn't "Do we have a backup?" but "How long will it take before we can work again?" – and only someone who has tested the scenario knows the answer to that.

Emergency plan: what to do in an emergency

In an emergency, the most consequential mistakes are made in the first few minutes – usually out of reflex to want to do something quickly.

The first steps

1. Disconnect affected systems from the network, but do not power them down. Disconnect the network cable or disable Wi-Fi. Shutting down the system destroys traces in RAM that are crucial for the investigation.
   
2. Immediately remove backups from the network to prevent them from being compromised as well.
   
3. Do not attempt to restore the system yourself until it is clear how the attackers gained access. Restoring to an open environment will directly lead to a second attack.
   
4. Inform the relevant parties: management, IT partners, and, if applicable, your insurance company.
   
5. Document: What was noticed and when, which systems are affected, and what steps were taken?
   
6. Check reporting obligations. If personal data is affected, deadlines may apply under the General Data Protection Regulation (GDPR). The Austrian Data Protection Authority describes the obligations of data controllers.
   
7. The contact point for affected individuals in Austria is onlinesicherheit.gv.at, which provides information on cybercrime and reporting procedures.

What needs to be clarified beforehand

An emergency plan is only useful if it's readable without functioning IT systems. If it's stored as a file on an encrypted server, it's useless.

We use bookstack for this on a separate and independent server.

The following should be defined in advance:

• Who makes the decisions, and who represents that person?
• Phone numbers for IT partners and insurance companies – on paper.
• In what order will systems be restored? What's needed first to get work started?
  
• How will communication take place if email and the phone system fail?
  
• What will we tell customers and suppliers?

This last point is regularly overlooked and determines the extent of reputational damage.

Should one pay a ransom?

Making a payment is generally discouraged for practical reasons:

• Decryption is not guaranteed, and the tools provided are often slow or faulty.
  
• Payment does not prevent the publication of already stolen data.
• Those who pay are perceived as willing to pay and are more likely to be targeted again.
  
• Depending on the recipient, legal issues may arise.

However, the decision is rarely made at a desk, but under pressure – when operations are at a standstill. This is precisely why a tested backup is the only way to confidently answer this question. Anyone who knows they will be operational again in two days isn't going to negotiate.

In a serious situation, consult your IT partner and, if applicable, your insurance company before contacting the attackers.

Ransomware protection checklist

• Multi-factor authentication for all accounts, especially for remote access
• Priority updates for externally accessible systems
• Email filter with link and attachment checking
• Remote maintenance not accessible from the internet without protection
• Modern endpoint protection with behavioral detection
• Designated person who actually reviews warning messages
• No administrator rights for day-to-day operations
• Network divided into separate areas
• Access rights limited to what is absolutely necessary
• Immutable backups with sufficient retention time
• An off-site backup copy
• Dedicated backup account with two-factor authentication
• Restore fully tested at least once a year
• Paper emergency plan with phone numbers and priority list
• Employees trained, reporting procedures known

Conclusion

Ransomware protection isn't a single product, but rather a combination of four layers: preventing intrusion, early detection, limiting spread, and recovery.

Because there's no such thing as complete protection, the fourth layer determines the consequences. An immutable backup, retained for a sufficient period and regularly tested, is the most important safeguard against total system failure—but only if access is restricted, recovery procedures are practiced, and responsibilities are clearly documented.

Equally important is preparing for an emergency. The most serious mistakes occur in the first few hours: systems are shut down instead of disconnected, recovery is attempted before the point of entry is closed, or no one knows who to call.

FIGULI CONSULTING helps SMEs establish ransomware protection as an ongoing security process: with multi-factor authentication, patch management, endpoint security, secure backups, monitoring, and a practical emergency plan.

Discuss ransomware protection with FIGULI

FAQ on Ransomware Protection

How do you protect a company from ransomware?

Through the interplay of four layers: preventing entry via multi-factor authentication, updates, and email filters; early detection via modern endpoint protection; limiting spread via network segmentation and restricted privileges; and the ability to restore via immutable, tested backups.

Is a virus scanner sufficient against ransomware?

No. Traditional antivirus software primarily detects known malware. Modern attacks use stolen login credentials and legitimate system tools, making them technically undetectable. What's needed is the detection of suspicious behavior combined with access restrictions and secure backups.

How does a backup protect against ransomware?

Only if the backup itself is inaccessible. Crucial factors are immutable backups that cannot be deleted for a defined period, even with administrator privileges; a separate backup account with two-factor authentication; and a retention period longer than the time until detection.

What should you do first in the event of a ransomware attack?

Disconnect affected systems from the network, but do not shut them down, as this will cause traces in the RAM to be lost. Immediately remove backups from the network. Do not restore them until the point of entry is unknown. Then inform management and IT partners and document everything.

Should you pay the ransom?

This is generally not recommended. Decryption is not guaranteed, data that has already been stolen is not protected, and paying the ransom is seen as a sign of willingness to pay. A tested backup is the only way to answer this question without pressure.

How long are attackers in the network beforehand?

Several weeks often pass between the initial intrusion and the encryption. During this time, data is copied, other accounts are compromised, and backups are searched for. This is why early detection and a sufficiently long backup retention period are so important.

Are small businesses also affected?

Yes. Attacks are predominantly automated and look for accessible vulnerabilities, not for specific company sizes. Small businesses are often more vulnerable because updates, access control, and backups get lost in the shuffle of daily operations.

Which ransomware protection measures should SMEs implement first?

SMEs should first enable multi-factor authentication for administrators and remote access, regularly patch externally accessible systems, set up email protection and reporting channels, reduce administrator privileges, and implement immutable backups with restore tests. These measures quickly reduce the risk and form the basis for further layers of protection.