Ransomware: Reduce the Damage and Prepare for Recovery

Ransomware can interrupt a business even when some files are recoverable. Attackers may also steal information, compromise administrator accounts or damage systems that backups depend on. Preparation should address access, containment and recovery, not only the encryption of documents.

Find out what your backup can actually recover

Choose a representative application and work through a restore test in an isolated environment. Include its database, configuration and required credentials, not just a folder of files. Measure how long recovery takes and confirm that the restored application is usable.

A permanently connected writable backup can be damaged by the same compromised account that accesses production. Use appropriately isolated, offline or immutable copies, with separate management access and retention that suits the business. Cloud synchronization alone is not proof of a recoverable backup. The NCSC's ransomware guidance covers backup protection and reducing the spread of an attack.

Reduce the routes into important systems

Patch supported systems, restrict remote administration and protect privileged accounts with suitable MFA. Separate routine work from administration. Review which accounts can write to shared folders and which systems can reach backup management. A compromised workstation should not automatically have access to every recovery tool.

For a small organization, start with one diagram or written inventory of the critical application, its identity provider, storage and backups. Mark who can administer each part. This often reveals a shared credential or forgotten remote-access account worth correcting before buying another product.

If you suspect an active incident

Follow the incident-response plan and notify the responsible team. Where safe and authorized, isolate affected devices from networks to limit spread, taking particular care with safety-critical systems. Preserve the ransom note, relevant logs and a timeline. Avoid improvised cleanup or rebuilding before responders have collected the evidence they need.

Do not assume every machine showing no ransom note is unaffected. Investigate the entry point, privileged access and possible data theft. Use a trusted communication channel if normal email or collaboration accounts may be compromised.

Restore into an environment you can trust

Recovery means more than copying files back. Remove the entry point, rebuild affected systems as appropriate, rotate compromised credentials and validate backup integrity before reconnecting restored services. Restore in a business-approved order and monitor for renewed activity.

A ransom payment does not guarantee usable decryption or deletion of stolen data. Decisions during an incident need qualified incident-response and relevant legal support. Keep the practical recovery checklist available offline, with contact details and tested access procedures, so the team does not have to find it inside the very system that has stopped working.