How to Prevent Ransomware: 10 Best Practice Tips

Ransomware is a form of malware that holds your data hostage in order to extort a ransom payment. Most ransomware groups follow a double extortion model, which means that attackers both encrypt your files and threaten to leak stolen data. Attacks are often accompanied by public announcements meant to put additional pressure on the victim. Affected organizations are asked to pay in order to restore access to their IT and avoid leaks of sensitive data.

However, paying ransomware gangs is a bad idea for two reasons:

Before ransomware can wreak havoc on your data, it first needs to infiltrate your network. Between initial access and total encryption, there is usually a quiet period of a few weeks. During this time, the malware tries to spread to different devices and systems while evading detection. This way, it can cause as much damage as possible once it makes its presence known.

Most ransomware attacks can be attributed to one of two attack vectors:

When you’re hit by a ransomware attack, a swift response can make a huge difference in minimizing the damage of the encryption trojan. So it’s important to know what sort of warning signs to look out for.

First, there are early warning signs that your organization is being targeted. This could be an increase in phishing attempts and suspicious emails, as well as alerts about blocked logins. If the infiltration is successful, you may notice suspicious behavior as the ransomware spreads through your system, such as the presence of AD scanning tools like Bloodhound or the credential stealing software Mimikatz.

Once the ransomware becomes active, your users might report their PCs acting sluggish or unresponsive as system files are being encrypted. Duplicates of files may appear bearing strange file extensions. Finally, there is the telltale sign of a ransom note asking you to make contact with the hackers, which could appear as a txt file on your desktop or a redirect on your browser.

Ransomware is a constant arms race. Cybercriminals aim to stay ahead of detection tools and network defenses, while security specialists track newly emerging ransomware strains in the hope of creating decryption tools for victims.

While ransomware can seem omnipresent and all-powerful, there are many steps you can take to reduce the risk of a successful attack on your network. We have compiled some of the most important countermeasures below. Please note: Ours is far from the only helpful list on this topic! Be sure to review suggestions by other experts.

More ransomware prevention sources:

Basic cyberhygiene can go a long way towards preventing ransomware attacks. This includes steps such as regularly cleaning up your Active Directory to prevent attackers from exploiting stale accounts or local admin privileges. In addition, ensure that the latest security updates are applied to all devices through a stringent patch management process.

With compromised user accounts being such a popular attack vector, anything you can do to prevent fraudulent logins greatly reduces the risk of your network being breached. Use strong passwords, but don’t rely on passwords alone to keep out intruders.

Multi-factor authentication alongside conditional access and risk-based identity verification are essential components of login security. Be sure to use modern, phishing-resistant MFA methods. For example, number matching MFA prompts help guard against MFA fatigue attacks.

Email security tools that filter out phishing attempts and scan for malicious links and attachments can stop ransomware from entering your system. However, even cutting edge email security won’t help if your employees are getting careless. Train your users to spot malicious emails through cybersecurity education and phishing tests.

Make sure that system, network and device settings are properly configured to prevent attackers from leveraging misconfigurations. On a network level, keep your firewall up to date and disable ports and protocols you do not need. Follow best practices for Active Directory security by limiting admin roles. Use group policy objects to manage device settings for web browsers and remote access. More information on systems hardening.

To limit ransomware’s ability to spread across your system, you need to restrict access rights for each account to the minimum level required for its role. This concept is known as least privilege access and forms the basis of modern zero trust security alongside continuous access evaluation.

Automated, role-based provisioning and deprovisioning ensures that each user only receives the permissions intended for their job and that privileges are automatically revoked when their role changes or they leave the organization.

Aside from automated lifecycle management, regular access audits known as user access reviews are necessary in order to limit users’ access to only strictly necessary privileges. Users frequently request and receive new permissions to handle short-term projects or collaborations. User access reviews ensure that these permissions are removed once they are no longer needed.

Established cybersecurity standards like ISO 27001 or NIST CSF offer reliable guidance for how to build a comprehensive cybersecurity program. IT practicioners might argue that certification alone is just a piece of paper that won’t keep you safe, and that’s true.

However, cybersecurity certifications are a good source of expert knowledge, can highlight gaps in your current security efforts and will help make security a permanent part of day-to-day operations. Additionally, the promise of certified cybersecurity could help you achieve management buy-in for cybersecurity spending.

Security awareness is critical to preventing ransomware attacks, since cybercriminals often exploit carelessness and user error through phishing, social engineering and other means. Make sure that everyone in your organization understands good cybersecurity practices, as well as how to respond to suspicious activity on their device.

Ideally, a full backup of critical systems will help you restore your IT without the need to decrypt your files. Ransomware gangs know this and will attack backups alongside your active systems, so be sure to keep a backup that is disconnected from your network. Experts recommend following the 3-2-1 rule: Have at least three copies of your data, on two different media types and with one of them off-site.

However, it’s not enough to have a backup strategy on paper, you also need to test your backups regularly. Untested backups are worse than no backups. They give the illusion of security, but may turn out useless in an emergency.

No amount of preparation can offer you total security. Which is why alongside safeguards to prevent ransomware attacks, you also need to get ready for the worst case scenario: a successful attack on your network.

Prepare a detailed incident response plan to guide you through this crisis. What are the specific steps needed to shut down your network, isolate the attack, root out the malware and restore your IT. Who is responsible for what? How will your emergency response team coordinate if your IT goes down? For guidance on how to build an incident response plan, you can draw on NIST reference documents such as SP 800-34 and SP 800-61.

Once you have created a response plan, you also need to put it to the test. Run through a simulated attack to see if everything works as planned and to make sure everyone on your team knows what to do in case of a real attack.

As you can see, companies that want to prevent ransomware attacks need to guard against all sorts of attack paths and potential exploits. At the same time, businesses don’t want to make cybersecurity their full-time job: They need cost-effective security solutions that protect their data without negatively impacting their IT team or their main business.

And that’s exactly why companies need tenfold : While other identity and access management solutions need months and tons of custom scripting to deploy, our innovative no-code IAM solution can be fully set up just a few weeks. With a suite of ready-to-go plugins for systems like Active Directory, Microsoft 365 and business apps like SAP or HCL Notes, IAM has never been easier! Don’t believe us? Watch our video overview for a full tour of our IAM platform.