A small or mid-sized business stops most ransomware with five controls: MFA on email and every remote access path, fast patching of internet-facing devices, backups with an offline or immutable copy that you actually test, EDR on endpoints and servers, and least privilege. If you are already hit, isolate affected systems without powering them off, activate your incident response plan, and make no decision about the ransom without legal and technical advice.
What ransomware is, and why double extortion changed the game
Ransomware is malicious software that encrypts an organization's files and systems to extort a payment in exchange for the decryption key. For years, good backups were the answer. Not anymore: most crews now use double extortion, stealing data before encrypting it and threatening to leak or sell it unless you pay.
That matters for an SMB. Even if you can restore everything, the theft of customer, employee or patient data is still a data breach, with notification duties under state law and possibly sector rules such as HIPAA. Prevention has to cover two fronts: attackers should not be able to encrypt you, and they should not be able to exfiltrate data without you noticing.
Size does not protect you. Attackers automate scanning for vulnerable servers and leaked credentials; they pick victims because a door was open, not because of revenue.
How ransomware typically gets in
Publicly analyzed cases point to four main initial access routes:
- Phishing: an email or message that harvests credentials or installs remote access tooling. Generative AI has made these messages fluent and targeted; see our guide on AI phishing and deepfakes.
- Exposed RDP or VPN without MFA: a server with Remote Desktop open to the internet and a reused password is still one of the most exploited entry points.
- Unpatched edge devices: firewalls, SSL VPNs, routers and remote access appliances with known vulnerabilities, often exploited within days of disclosure.
- Stolen or purchased credentials: passwords from other breaches, or session data captured by infostealer malware on an employee's personal machine.
After getting in, attackers usually spend days or weeks moving laterally, escalating privileges, deleting backups and staging data for exfiltration. Encryption is the last step. That dwell time is your detection window.
Prioritized prevention controls for an SMB
You do not need an enterprise budget, but you do need an order of operations. This table ranks controls by how much they reduce the routes above, consistent with the CISA #StopRansomware Guide:
| Priority | Control | What it stops |
|---|---|---|
| 1 | MFA on email, VPN, remote access, cloud consoles and admin accounts (phishing-resistant where possible: FIDO2 keys or passkeys) | Stolen credentials, phishing |
| 2 | No RDP exposed to the internet; patch edge devices in days, not months | Exploitation of known vulnerabilities |
| 3 | 3-2-1-1-0 backups with an offline or immutable copy and restore tests | Data loss from encryption |
| 4 | EDR on every workstation and server, with someone watching alerts | Malware execution, lateral movement |
| 5 | Least privilege: separate admin accounts, no local admin for everyday users | Privilege escalation |
| 6 | Network segmentation: servers, backups and user devices on separate segments | Spread of encryption |
| 7 | Email security: filtering, SPF, DKIM and DMARC, macros blocked in external Office files | Phishing, domain spoofing |
Use the CISA Known Exploited Vulnerabilities (KEV) catalog to triage patching: if a flaw in your firewall or VPN is listed, it is being used in real attacks. If you run on AWS, the same logic applies to identities and accounts; see our AWS hardening checklist.
Backups that survive ransomware: the 3-2-1-1-0 rule
Attackers hunt for backups and delete them before encrypting. A NAS on the same network, reachable with the same domain credentials, usually goes down with everything else. The widely used 3-2-1-1-0 rule summarizes what works:
- 3 copies of your data (production plus two backups).
- 2 different storage types.
- 1 copy offsite or in another cloud region or account.
- 1 copy offline or immutable, which nobody can delete or alter during its retention period, not even an administrator.
- 0 errors in restore tests.
The last digit is the one most companies skip. Run at least a quarterly full restore of a critical system (your ERP, billing database or file server) and time it. If restoring takes four days and the business can tolerate one, you want to learn that in a drill, not mid-incident. Keep backup admin credentials separate from your directory, with their own MFA.
What to do in the first hours
The response checklist in the #StopRansomware Guide (CISA, FBI, NSA and MS-ISAC) is a solid baseline. Adapted for an SMB:
- Isolate affected systems. Disconnect them from the network (wired and Wi-Fi). If many are affected, take the network offline at the switch level. Coordinate by phone, not corporate email, which may be compromised.
- Power down only as a last resort. Shutting down destroys volatile evidence that helps establish how the attacker got in.
- Activate your incident response plan and convene leadership, IT, legal counsel, your cyber insurer and your security provider. If you have no plan, start with our incident response plan guide.
- Triage restoration order from a predefined list of critical assets.
- Preserve evidence: the ransom note, firewall, EDR and cloud logs. Copy before you clean.
- Reset credentials from a clean device, starting with admin, email and backup accounts.
- Verify backups are clean before restoring so you do not reinstall the attacker's foothold.
Should you pay the ransom?
The agencies behind the #StopRansomware Guide do not recommend paying: payment does not guarantee you get your files back or that stolen data is deleted, and it funds further attacks. Many victims who pay receive slow or partial decryptors and still face a leak.
The decision is ultimately the company's, but make it with full information. Confirm whether your backups allow recovery, check whether a free decryptor exists for the variant (the No More Ransom project collects them), and involve counsel. The US Treasury's Office of Foreign Assets Control (OFAC) has warned that payments to sanctioned actors carry sanctions risk, and it treats prompt reporting and cooperation with law enforcement as mitigating factors. Never negotiate without specialized help.
Reporting obligations in the US
- Law enforcement: report to the FBI through IC3 or your local FBI field office, and consider CISA. Federal agencies may know of decryptors or the actor's tactics.
- State breach laws: every US state has a breach notification law. If personal information was accessed or exfiltrated, you may have to notify affected residents and, in some states, the attorney general, within deadlines that vary by state.
- Sector rules: healthcare entities and their business associates have HIPAA breach notification duties; public companies may need to disclose material incidents to the SEC. Our incident response guide covers these briefly.
- Contracts and insurance: customer contracts and cyber policies often require notice within short windows. Check them before you need them.
Common mistakes we see
- Backups exist, but nobody has ever restored a full system.
- MFA on email but not on the VPN, the firewall admin page or the cloud console.
- Antivirus with no monitoring: nobody sees the alert at 2 a.m. on a holiday weekend, which is exactly when encryption is launched.
- A managed service provider using a shared admin account without MFA.
- Assuming cloud means backed up: if an attacker deletes your bucket or database, the provider is not obliged to have a copy for you.
If you are not sure which of these apply to you, an external security assessment and penetration test will show you before an attacker does.
Frequently asked questions
Is antivirus enough to stop ransomware?
No. Traditional antivirus catches known malware, but many intrusions rely on legitimate admin tools and stolen credentials that raise no signature alerts. You need EDR with someone reviewing alerts, MFA on all access, patched edge devices and immutable backups. Antivirus is one layer, not the strategy.
How long does it take a small business to recover from ransomware?
It depends mostly on backup quality and preparation. With tested immutable backups and a list of critical systems, core operations can return within days. Without usable backups, recovery can take weeks and require rebuilding systems from scratch. Forensics, legal review and notifications run in parallel and often extend the timeline.
Do I have to report a ransomware attack to the FBI?
For most private companies, reporting to the FBI is strongly encouraged rather than legally required, but other duties may apply: state breach notification laws if personal data was involved, HIPAA for healthcare data, SEC disclosure for material incidents at public companies, and contractual or insurance notice clauses. Reporting through IC3 also gives you access to federal resources.
Do cloud backups protect against ransomware?
Only if attackers cannot delete them. A cloud backup reachable with the same credentials as your production environment can be wiped. Look for immutable retention or object lock, a separate account with its own MFA to manage backups, and regular restore tests. That combination turns a copy into a real defense.
What if the attackers threaten to leak our data?
Treat it as a confirmed or probable data breach: activate your plan, preserve evidence, use forensics to determine what data left, prepare notifications under the applicable state laws, and involve legal counsel before any contact with the attackers. Paying does not guarantee the data is destroyed.
Conclusion
Ransomware is not a large-enterprise problem, and reducing it does not require a large-enterprise budget. MFA, patched edge devices, tested immutable backups, EDR and least privilege close most doors. What makes the difference on the day of an attack is having prepared the response and reporting steps in advance.
MisterProSoft is a nearshore security team working in UTC-5, the same business hours as US Eastern and Central time. We test your real exposure with penetration testing, review cloud and backup configurations, and help you build a response plan. Explore our cybersecurity services or book a free consultation.