Ransomware prevention for businesses

Ransomware is no longer a distant threat reserved for large corporations; today, ransomware attacks against small and medium-sized businesses are increasing at an alarming rate. According to security reports, over 70% of ransomware attacks target organizations with fewer than 100 employees, simply because these businesses typically have weaker defense infrastructures. If you are an IT manager or a business owner, you have probably asked yourself, "Where do I start?" The short answer is: ransomware prevention is not a one-time project, but a combination of three main layers — offline backups, the principle of least privilege, and employee training. In this article, we will examine all three layers with technical details and practical examples so you can implement them starting today.

Layer One: Offline Backup — The Only Guaranteed Rescue

Many businesses believe that because they perform backups, they are safe from ransomware. But the harsh truth is that modern ransomware like LockBit and BlackCat specifically target online backups. If your backup resides on an always-connected network share or cloud service, an attacker can encrypt or delete it. The definitive solution is an offline backup.

Why Is Offline Backup Effective?

An offline backup means a copy of your data that is physically or logically isolated from the network, and to which the attacker has no access. This backup must be configured so that even if your entire network is compromised, the backup data remains untouched. There are three common methods for offline backup:

• Backup on an external hard drive disconnected from the network: The simplest method; connect the drive only during the backup and disconnect it immediately afterward.
• Backup on a separate server in an isolated network: A server that is not connected to the main network and only receives backups through a controlled path (such as a VPN).
• Cloud backup with Object Lock capability: Services such as S3 Object Lock or Wasabi that prevent files from being modified or deleted until a specified date.

Practical Implementation of Offline Backup with rsync

Suppose you have a Linux server and want to create an offline backup on an external hard drive. The best tool is rsync. First, connect the drive to the system and mount it:

sudo mkdir -p /mnt/backup
sudo mount /dev/sdb1 /mnt/backup

Then create a simple backup script that copies the important directories:

#!/bin/bash
# backup.sh - Offline backup of critical directories
BACKUP_DIR="/mnt/backup/$(date +%Y-%m-%d)"
mkdir -p "$BACKUP_DIR"

rsync -avz --delete /var/www/html "$BACKUP_DIR/www/"
rsync -avz --delete /etc "$BACKUP_DIR/etc/"
rsync -avz --delete /var/lib/mysql "$BACKUP_DIR/mysql/"

After running the script, unmount the drive:

sudo umount /mnt/backup

Important note: never leave the drive permanently connected to the system. If an attacker gains access to the system, the connected drive is also at risk.

Recovery Testing — The Forgotten Step

Having a backup without testing recovery is equivalent to having no backup at all. At least once a month, restore a file from the backup and verify its integrity. For a more thorough test, create a virtual machine and restore the entire system from the backup. This takes time, but on the day of an incident, it makes the difference between a 2-hour outage and a 2-day outage.

Layer Two: The Principle of Least Privilege

Ransomware typically enters a system through a user account with high-level access. If all your employees have Administrator or root accounts, one small mistake can destroy the entire network. The principle of least privilege means that each user should only have access to the resources they need to perform their job — nothing more.

Implementing Least Privilege in Windows

In a Windows environment, first review user accounts and ensure that no one uses an Administrator account for daily work. Create a standard account for each user and only use UAC (User Account Control) for temporary privilege elevation when needed. For better management, use Group Policy:

# Disable execution of executable files from the AppData folder
Computer Configuration > Administrative Templates > System > 
  Don't run specified Windows applications - Enabled
  List of disallowed applications: cmd.exe, powershell.exe

Also, restrict access to network shares. Instead of giving everyone full access, only share the folders each department needs and set the access level to Read-Only unless write access is required.

Implementing Least Privilege in Linux

In Linux, use sudo instead of su and only allow specific users to run specific commands. Edit the /etc/sudoers file with the visudo command:

# Allow only user ali to run systemctl and apt
ali ALL=(ALL) /usr/bin/systemctl, /usr/bin/apt

Additionally, review running services and disable unnecessary ones. Every extra service is another attack surface.

Layer Three: Employee Training — The Weakest Link or the Strongest Defense?

More than 90% of ransomware attacks begin with a phishing email. An employee who clicks on a malicious link or opens an infected file has effectively opened the door for the attacker. Employee training must be continuous and practical, not a boring annual lecture.

What Does an Effective Training Program Look Like?

• Phishing simulations: Send a test phishing email to employees every month and see who clicks. Tools like GoPhish or KnowBe4 automate this process.
• Short, regular sessions: Instead of one 3-hour session, hold 15-minute training sessions each month. Vary the topics: phishing, social engineering, passwords, and software updates.
• Reporting policy: Tell employees to report suspicious emails to the IT team. No one should be punished for reporting a suspicious email; on the contrary, they should be encouraged.

Simple Rules Every Employee Should Know

1. Never click on links or attachments in unsolicited emails, even if the sender appears familiar.
2. Before entering a password, check the URL. Fake domains like bank-verify.com instead of bank.com are common.
3. Never share your password with colleagues.
4. If a page displays a "Your files have been encrypted" message, do not turn off the system and notify IT immediately.

Additional Measures: Updates and Monitoring

Have you implemented the three main layers? Great. But for complete ransomware prevention, a few additional measures are also necessary. First, regularly update the operating system and software. New ransomware often exploits known vulnerabilities for which patches have already been released. If you do not install the patches, you are essentially leaving the door open for attackers. Second, monitor logs. Tools like Wazuh or Splunk can detect unusual behaviors such as accessing a large number of files in a short period — which is exactly what ransomware does during encryption.

Conclusion: Where to Start?

Ransomware prevention is not difficult, but it requires commitment and discipline. If you are just getting started, follow this order:

1. This week: Take an offline backup of your most critical data and test it.
2. This month: Review user access and remove unnecessary accounts. Apply the principle of least privilege to everyone.
3. This quarter: Launch an employee training program and run your first phishing simulation.

Remember that security is not a destination but a journey. Threats are constantly evolving, and so must your strategy. If you need a secure and scalable infrastructure, companies like ServerNet offer hosting and cloud infrastructure services that can serve as a reliable foundation for your security strategy. But the most important investment is the awareness and preparedness of your own team. Start today; tomorrow may be too late.