Ransomware planning gets much clearer when you stop asking, “How do we guarantee this never happens?” and ask a better question: “If one account or computer is compromised, how far can the damage spread—and how quickly can we recover?”

For a small or midsize company, ransomware is a business-continuity problem as much as a malware problem. Modern attacks often involve stolen credentials, remote access, data theft, and attempts to damage backups before encryption ever begins. A useful plan therefore needs layers: prevention, detection, containment, and tested recovery.

What to focus on first

Protect identities first

Require strong MFA on email, remote access, and administrative accounts. Where possible, move privileged users toward phishing-resistant methods rather than relying only on push approvals or SMS codes.

Keep endpoints visible

Use centrally managed endpoint protection or EDR so suspicious scripts, credential theft, and unusual encryption behavior can be investigated quickly. A device that is simply “running antivirus” is not the same as a device someone is actively watching.

Separate and harden backups

Keep recovery copies separated from normal production credentials and use immutable or otherwise protected storage. Attackers should not be able to erase the recovery path with the same account they used to compromise a server.

Limit lateral movement

Segment networks and remove unnecessary administrative access. If one workstation is compromised, it should not automatically have a clear path to accounting systems, servers, backups, or every other computer.

Practice the first hour

Document who will disconnect systems, contact the IT/security team, notify leadership, preserve evidence, and make business decisions. A short written plan is far better than inventing the response while systems are down.

Common ways this goes wrong

• Assuming cloud file sync is a complete backup strategy.
• Using the same administrative credentials for production systems and backup management.
• Waiting for an incident to discover that a restore is too slow or incomplete.

Make it part of normal operations

Treat this as a recurring operating responsibility, not a one-time project. Review the control after major account, application, network, or staffing changes; keep ownership clear; and make sure important exceptions are written down. A small business does not need a complicated governance program, but it does need to know who notices when a protection stops working and who has authority to fix it.

Questions worth bringing to your next IT review

• Can we explain how the ‘Protect identities first’ practice works today without relying on one person’s memory?
• Where do we have exceptions to ‘Keep endpoints visible’, and are those exceptions still necessary?
• Who owns the work behind ‘Separate and harden backups’, and what evidence shows it is working?
• How would we discover that this control or process stopped working?
• What business, staffing, vendor, or technology change should trigger another review?

What a solid approach looks like

A solid ransomware posture does not depend on one product. It gives attackers fewer ways in, limits what a compromised identity can reach, creates visibility when behavior changes, and preserves a recovery path that has been tested. That combination turns a potentially existential event into a problem the business has already prepared to handle.

If you want to go one level deeper, see Managed Detection and Response.

If your organization would benefit from help reviewing the current environment or turning these ideas into a workable plan, Cloud Backup Services from CTResources is available as a practical next step. The goal is to strengthen what matters without adding unnecessary complexity.