Ransomware is not only a problem for banks and hospitals. Small businesses are attractive targets because attackers expect thinner defences and a strong urge to get back online quickly. The good news: a short list of disciplined habits blocks or softens most attacks. We built this guide from the US government's CISA #StopRansomware Guide and the Federal Trade Commission's small-business advice, then cross-checked it with a practitioner guide from Splashtop. Vendor material is flagged where it promotes a product.
Key takeaways
- Keep encrypted, offline backups and test restoring them.
- Require multi-factor authentication, ideally phishing-resistant, on email, remote access and admin accounts.
- Patch quickly, especially internet-facing systems, and never expose remote desktop directly.
- Train staff, limit admin rights and write an incident response plan before you need it.
How Ransomware Usually Gets In
- Phishing email with malicious links or attachments. The FTC notes ransomware often starts with email and that criminals use personal details to make messages look like they come from coworkers; see how to spot phishing.
- Stolen or weak credentials on remote access tools, VPNs and email.
- Unpatched software, particularly internet-facing systems with known exploited vulnerabilities.
- Exposed remote desktop and misconfigured file sharing.
- Compromised third parties, such as an IT provider with broad access.
10 Steps to Protect Your Business
- Back up, offline and encrypted. CISA's prevention list calls for encrypted offline backups, regular restore tests and a library of "golden" system images; the FTC asks for encrypted copies kept separate from your main network and not constantly connected to it. A common way to remember it is three copies, on two types of storage, with one offline or immutable, though CISA's own wording focuses on offline and tested.
- Test your restores. A backup you have never restored is a hope, not a plan. Splashtop adds that you should patch backup servers too.
- Require multi-factor authentication. CISA recommends phishing-resistant MFA, and Splashtop lists VPNs, remote access tools, email and all admin accounts. Our 2FA guide shows how, and passkeys are stronger still.
- Patch fast. Start with actively exploited vulnerabilities and internet-facing systems, VPNs and backup servers, and automate it so it does not depend on someone remembering.
- Close exposed doors. Do not expose RDP to the internet, disable unused ports and protocols, and retire legacy file-sharing versions, as CISA advises.
- Use unique passwords and a password manager. CISA suggests 15+ character passwords, lockouts and separate admin accounts; the FTC says never reuse passwords across platforms. Start with our password manager guide.
- Limit access. Give people and tools only the permissions they need, use separate administrator accounts for privileged work and remove accounts of former staff straight away.
- Deploy endpoint protection on every computer, ideally with central visibility. Splashtop notes EDR only helps if someone acts on its alerts, and recommends approving one remote-access tool and blocking others, because attackers often install legitimate tools to keep access.
- Filter email and train your team. Filter attachments, implement DMARC and disable macros, as CISA lists. Train staff regularly with short practical sessions and make it safe to report a mistake. The FTC offers free modules.
- Write an incident response plan. Keep offline copies of the plan and contact list; see what to do after a ransomware attack.
Do Not Forget Third Parties, the Cloud and Your Website
CISA recommends vetting managed service providers, limiting their access and writing security requirements into contracts. Cloud storage and websites are targets too: use strong access controls, enable file versioning and keep your site's software and plugins updated. Our overview of small-business cyber threats covers the wider picture.
A Simple Monthly Checklist
- Confirm the latest backup completed, and restore one file to prove it works.
- Review who has admin access and remove anyone who no longer needs it.
- Check that updates are installed on every device and server.
- Remind staff of one current scam example.
- Check logs for unusual sign-ins or new remote-access tools.
About Paying the Ransom
Authorities generally advise against paying. Payment does not guarantee recovery, and it funds further attacks. Strong backups remove most of the pressure. If the FBI or your local cybercrime unit is available, the FTC says to contact them straight away because ransomware is a crime.
Take the First Step Today
You do not need an enterprise budget to be resilient. Start with backups and multi-factor authentication this week. If you would like a security review of your website, applications or cloud setup, the Node-devs team can help you find and fix the gaps.
References and further reading
This guide was compiled from the sources below. We compared them, kept the points they agree on and wrote the article in our own words. Check the originals for more detail.
- #StopRansomware Guide (CISA)
- Reduce your ransomware risk: 2 preventive steps for your small business (US Federal Trade Commission)
- Ransomware protection for small business (Splashtop)
