Ransomware: Prevention and a Response Plan

Ransomware is malicious software that encrypts your files, and often steals copies first, then demands payment to restore access or prevent publication. The most reliable way to prevent damage is layered: keep software patched, use multi-factor authentication, limit administrative access, filter email, close exposed remote access, and hold tested backups that attackers cannot reach. The most reliable way to survive an attack is a written response plan you have rehearsed, covering how to isolate systems, who to call, how to restore, and when to report. This article sets out both.

How ransomware attacks unfold

Modern ransomware incidents are rarely a single click that instantly locks everything. They tend to follow stages:

1. Initial access via a phishing message, stolen credentials, an exposed remote desktop or VPN, or an unpatched internet-facing system.
2. Foothold and discovery. The attacker explores the network, looks for backups and finds privileged accounts.
3. Privilege escalation and spread to servers, file shares and backup systems.
4. Data theft in many cases, to add pressure through a threat of publication.
5. Encryption and ransom note, often timed for evenings, weekends or holidays when fewer people are watching.

The gap between stages 1 and 5 is your opportunity: good monitoring and quick response can stop an attack before encryption.

Prevention: the controls that matter most

Protect accounts

Enforce MFA on email, remote access and all administrator accounts. Use unique strong passwords, as covered in our password policy guide. Give administrators separate accounts for admin work and ordinary tasks.

Patch promptly

Prioritise internet-facing systems such as VPNs, firewalls, mail servers and web applications. Maintain an inventory so you know what needs updating and retire unsupported systems.

Reduce the attack surface

Do not expose remote desktop directly to the internet. Close unneeded ports and services. Review firewall rules periodically and disable accounts and software you no longer use.

Filter and train

Email scanning, attachment controls and sensible blocking of risky file types lower exposure. Train staff to spot and report suspicious messages; see how to spot and respond to phishing.

Limit the blast radius

Apply least privilege so a compromised user cannot reach everything. Segment the network so workstations cannot freely talk to servers and backups. Restrict who can run scripts and install software.

Detect early

Endpoint protection with behavioural detection, centralised logs, and alerts for unusual activity such as mass file changes, new admin accounts, or large outbound transfers give you a chance to intervene. Someone must be responsible for looking at the alerts, including out of hours where practical.

Back up properly

Backups decide whether an attack is an expensive disruption or a business-ending event. Apply the 3-2-1 rule of thumb: three copies, two media types, one offline or immutable. Keep backup credentials separate from your normal admin accounts, so a compromised domain admin cannot delete them. Test restores of individual files and of complete systems, and record how long a full restore takes, because that is your realistic recovery time.

Prevention checklist

Control	Question to ask
MFA	Is it enforced on email, admin and remote access?
Patching	Are internet-facing systems updated promptly and nothing unsupported left running?
Remote access	Is anything exposed directly to the internet without MFA?
Privileges	Do people have only the access their job needs?
Backups	Is one copy offline or immutable, and has a restore been tested recently?
Monitoring	Would anyone notice mass file changes at 2am?
Training	Do staff know how and where to report suspicious activity?
Plan	Is there a written, rehearsed response plan?

Your response plan

Write this before an incident, keep a printed copy somewhere that does not depend on your IT being up, and rehearse it with a short tabletop exercise.

1. Contain

Isolate affected devices from the network: unplug cables, disable Wi-Fi, or use your endpoint tool to quarantine. Do not simply power everything off without thought, as memory may hold useful evidence, but do stop the spread. Disable compromised accounts and block suspicious connections. Do not wipe machines yet.

2. Call the right people

Have the numbers ready: your IT provider or security specialist, your cyber insurer if you have one, your bank if funds are at risk, legal counsel, and a named decision-maker internally. Agree who communicates with staff, customers and the media.

3. Assess

Work out what is affected, how the attacker got in, whether data was taken, and whether backups are intact. Preserve logs and take notes with timestamps. If personal data may be involved, begin your breach assessment straight away, because GDPR notification windows are short. The Data Protection Commission is the Irish regulator; this is not legal advice.

4. Report

Consider reporting to An Garda Síochána and notifying the National Cyber Security Centre, in addition to any data protection notification. Your advisers can confirm what applies to you.

5. Eradicate and recover

Remove the attacker's access before restoring, or you may be re-encrypted. That usually means resetting credentials broadly, patching the entry point, and rebuilding affected systems from clean sources rather than cleaning them in place. Restore data from known-good backups, starting with the systems the business needs most. Monitor closely for several weeks afterwards.

6. Review

Run a blameless review: what happened, what worked, what failed, what will change. Update the plan and the controls accordingly.

The ransom question

Whether to pay is a business, legal and ethical decision. Payment does not guarantee recovery, may not stop data being published, and can encourage repeat targeting. In some circumstances, paying certain parties could raise legal issues. Prepare your position in advance with advisers, rather than making the decision under stress in the middle of an incident.

Running a tabletop exercise

A tabletop exercise costs nothing but an hour. Gather the people named in your plan, describe a scenario (for example, "it is Saturday night, files on the main server have been renamed and a note has appeared"), and walk through what each person would do. Ask practical questions. Who can authorise taking the network offline? Where are the phone numbers? Which system do we restore first and who is waiting for it? How do we communicate with staff if email is down? Where are the offline backups and who has access? Note every point where the group hesitates, and fix those gaps. Repeat the exercise at least annually and after major changes. The aim is not a perfect script but a team that has already had the difficult conversations and knows who decides.

Common mistakes

• Backups reachable from the same network and accounts. Attackers look for them first.
• Never testing a restore. You discover problems in the worst possible moment.
• No offline copy of the plan. The document is on the server that is encrypted.
• Restoring before removing the attacker. You may simply be hit again.
• Delaying the call for help. Early specialist involvement preserves options and evidence.
• Underestimating data theft. Even if you restore from backup, stolen data can still be published or misused.

Next steps

Start by testing a restore and confirming you have an offline copy, then tighten MFA, patching and remote access. Our cybersecurity checklist gives the broader sequence. If you would like an experienced view on your readiness, our cybersecurity solutions include security audits and threat monitoring, and we can discuss how to approach your environment.