Mitigating Ransomware Attacks: Tips for Small Business Owners

Ransomware hits small businesses hard because attackers assume they have thin IT staffing, patchy backups, and a strong need to get back online fast. Verizon's 2025 Data Breach Investigations Report found ransomware in 44% of the breaches it analyzed, and in small businesses it was present in a far larger share of breaches than in large organizations. A 12-person accounting firm that loses its file server on a Monday in March has a real problem: tax deadlines do not move. The good news is that a short list of layered defenses, closely aligned with CISA's #StopRansomware Guide and the NIST Cybersecurity Framework 2.0, stops or limits most attacks. This guide walks through them in the order you should do them, with commands and settings you can apply this week.

Inventory Your Critical Data, Devices, and Accounts

You cannot protect what you have not listed. Asset inventory is the first control in the CIS Critical Security Controls (Control 1 covers hardware, Control 2 covers software), and the NIST CSF 2.0 'Identify' function starts there too. Spend an hour building a simple spreadsheet with three tabs: data, devices, and accounts. For each item, record where it lives, who owns it, and how long the business could survive without it. This is a lightweight version of the business impact analysis described in NIST SP 800-34.

Data: client files on the NAS (\\fileserver\clients, 480 GB), QuickBooks company file (2 GB), shared mailbox archive (60 GB), HR documents in Google Drive.
Devices: 14 laptops, 2 desktops, 1 Synology NAS, 1 office firewall, 3 phones with email access.
Accounts: Microsoft 365 tenant admin, domain registrar login, banking portal, payroll provider, firewall admin, backup service admin.
Rank each item: 'down for 1 hour is fine', 'down for 1 day hurts', 'down for 1 week could close us'. Back up and protect the third category first.

On a Windows machine you can quickly pull a device list and software inventory to seed the sheet:

# Run in PowerShell on each PC (or via your RMM tool)
Get-ComputerInfo | Select-Object CsName, OsName, OsVersion, CsTotalPhysicalMemory

# Installed software, exported to CSV
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Select-Object DisplayName, DisplayVersion, Publisher |
  Export-Csv -Path C:\Temp\software-$env:COMPUTERNAME.csv -NoTypeInformation

Set Up 3-2-1 Backups with an Offline or Immutable Copy

The 3-2-1 rule, which CISA and US-CERT have long recommended, means three copies of your data, on two different types of media, with one copy offsite. For ransomware, add a fourth requirement: at least one copy must be offline or immutable, meaning the attacker cannot delete or encrypt it even with stolen admin credentials. CISA's #StopRansomware Guide specifically advises keeping offline, encrypted backups, because ransomware operators routinely hunt for backup shares and delete Windows shadow copies (for example with vssadmin delete shadows) before encrypting.

Copy 1: live data on the file server.
Copy 2: nightly backup to a local NAS or external disk (different media).
Copy 3: encrypted cloud backup with object lock or versioning enabled, or a rotated external drive that is unplugged and stored offsite.

If you use Backblaze B2 or AWS S3 as a target, enable Object Lock (both document it as WORM-style, write-once-read-many protection) so backups cannot be deleted for a set retention period. Here is an example using restic to back up to S3-compatible storage, with a bucket that has Object Lock enabled:

export AWS_ACCESS_KEY_ID="AKIAEXAMPLEKEY123"
export AWS_SECRET_ACCESS_KEY="example-secret-key"
export RESTIC_PASSWORD_FILE=/root/.restic-pass

# One-time repository setup
restic -r s3:s3.us-west-002.backblazeb2.com/acme-backups init

# Nightly backup of the client share
restic -r s3:s3.us-west-002.backblazeb2.com/acme-backups \
  backup /srv/clients --tag nightly

# Keep 14 daily, 8 weekly, 12 monthly snapshots
restic -r s3:s3.us-west-002.backblazeb2.com/acme-backups \
  forget --keep-daily 14 --keep-weekly 8 --keep-monthly 12 --prune

One caveat: pruning deletes objects, and Object Lock will refuse deletions until the retention period expires. Set the lock retention a little shorter than your oldest snapshot you intend to prune, or run prune from a separate, tightly controlled credential. The credentials used for the nightly job should have write-only permission where your provider supports it (Backblaze application keys and AWS IAM policies both allow this), and your backup admin login should be separate from your everyday admin account and protected by MFA. If an attacker can log in as a domain admin and also reach your backup console, your backups are not really safe.

Test Restoring Your Backups to Confirm They Work

A backup you have never restored is a hope, not a plan. NIST SP 800-34 lists backup testing as a required part of contingency planning, and CISA's guide recommends regularly testing backup availability and integrity. Schedule a restore test every month for a sample of files and every quarter for a full system. Time the process with simple arithmetic: 480 GB is about 3,840 gigabits, and at a realistic 80 Mbps of sustained throughput on a 100 Mbps connection that is roughly 13 hours. You need to know that before an incident, not during one.

# List available snapshots
restic -r s3:s3.us-west-002.backblazeb2.com/acme-backups snapshots

# Restore the latest snapshot of one folder to a scratch directory
restic -r s3:s3.us-west-002.backblazeb2.com/acme-backups \
  restore latest --target /tmp/restore-test --include /srv/clients/Smith-LLC

# Verify integrity of the repository (reads a 10% sample of data)
restic -r s3:s3.us-west-002.backblazeb2.com/acme-backups \
  check --read-data-subset=10%

# Spot-check that files open and counts match
find /tmp/restore-test -type f | wc -l

Write the result in a log: date, what you restored, how long it took, and who verified that the files opened correctly. Also confirm that your most critical application, such as QuickBooks, actually launches against the restored file.

Enable Multi-Factor Authentication on Email, VPN, and Admin Accounts

Stolen credentials are consistently among the top initial access routes in Verizon's DBIR, and CISA lists compromised credentials alongside phishing and unpatched internet-facing systems as the most common ransomware entry points. Microsoft's research on account compromise found that MFA reduces the risk of compromise by 99.22% across the population studied, and by 98.56% even when leaked credentials were involved. Prioritize in this order: email (Microsoft 365 or Google Workspace), remote access (VPN, RDP gateways, remote management tools), admin accounts for every system, then banking and payroll. Prefer an authenticator app or hardware security key (FIDO2) over SMS codes; NIST SP 800-63B classes SMS as a 'restricted' authenticator because of SIM-swap and interception risk.

In Microsoft 365, the quickest route is Security Defaults, which Microsoft provides free and which requires all users to register for MFA, or a Conditional Access policy if you have Business Premium. You can check the state of per-user MFA with PowerShell:

# Requires the Microsoft Graph PowerShell module
Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All","User.Read.All"

# List users and whether they have any MFA method registered
Get-MgUser -All | ForEach-Object {
  $methods = Get-MgUserAuthenticationMethod -UserId $_.Id
  [PSCustomObject]@{
    User       = $_.UserPrincipalName
    MethodCount = ($methods | Where-Object { $_.AdditionalProperties.'@odata.type' -ne '#microsoft.graph.passwordAuthenticationMethod' }).Count
  }
} | Sort-Object MethodCount | Format-Table -AutoSize

Anyone with a MethodCount of 0 has no MFA. Fix those accounts first, starting with administrators. Also disable legacy authentication protocols (POP, IMAP, basic SMTP auth) if no one needs them, since they cannot perform MFA challenges; Microsoft has been retiring basic authentication in Exchange Online for this reason.

Turn On Automatic Updates and Patch Known Vulnerabilities

Ransomware crews routinely exploit vulnerabilities that already have patches available, especially in VPN appliances, firewalls, remote access tools, and Exchange or other internet-facing servers. CISA maintains a Known Exploited Vulnerabilities (KEV) catalog that flags which CVEs are being used in real attacks, and it flags those used in ransomware campaigns; federal agencies must fix KEV entries within the deadline set in Binding Operational Directive 22-01 (typically two weeks or less). A small business can borrow that standard: critical and KEV-listed fixes on internet-facing systems within 7 days, and everything else within 30 days. You can subscribe to KEV updates by email or RSS at cisa.gov.

Windows: use Windows Update for Business or Intune rings; set active hours so reboots happen overnight.
macOS: enable automatic security updates under System Settings > General > Software Update.
Firewall and router: check firmware monthly and subscribe to the vendor's security advisory emails; compare your firmware version against the KEV catalog for your vendor.
Third-party apps: Chrome, Adobe Reader, Zoom, and Java are frequent targets; use winget or your RMM tool to keep them current.
Retire anything unsupported. Windows 10 reached end of support on October 14, 2025, so any remaining Windows 10 machine must either be enrolled in Microsoft's paid Extended Security Updates program or be upgraded to Windows 11 or replaced.

# Check for pending Windows updates (PSWindowsUpdate module)
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate

# Install all available security updates and reboot if needed
Install-WindowsUpdate -Category "Security Updates" -AcceptAll -AutoReboot

# Upgrade third-party apps with winget
winget upgrade --all --silent --accept-source-agreements

Install and Configure Endpoint Protection (EDR/Antivirus) on Every Device

Modern endpoint protection looks at behavior, such as a process rapidly renaming thousands of files, instead of relying only on known malware signatures. For a small business, Microsoft Defender for Business (included in Microsoft 365 Business Premium), CrowdStrike Falcon Go, SentinelOne, or Sophos Intercept X are common choices. Whichever you pick, deploy it to every laptop, desktop, and server, and make sure someone receives the alerts. An unmonitored EDR console that nobody reads provides far less protection than the license cost implies.

If you rely on Microsoft Defender, confirm that tamper protection and ransomware-specific features such as Controlled Folder Access are on:

# Check Defender status
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, IsTamperProtected, AntivirusSignatureLastUpdated

# Enable Controlled Folder Access (blocks untrusted apps from changing protected folders)
Set-MpPreference -EnableControlledFolderAccess Enabled

# Protect an extra folder
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\ClientFiles"

# Turn on cloud-delivered protection and network protection
Set-MpPreference -MAPSReporting Advanced -EnableNetworkProtection Enabled

Tip: Microsoft's own deployment guidance recommends running Controlled Folder Access in audit mode first (Set-MpPreference -EnableControlledFolderAccess AuditMode). Two weeks is a reasonable window. The Event Viewer log (Microsoft-Windows-Windows Defender/Operational, event ID 1124) shows which legitimate apps, like your accounting software, would be blocked so you can allow-list them before enforcing.

Restrict User Privileges and Segment Your Network

If a staff member's laptop is infected and that person is a local administrator with access to every file share, the attacker inherits all of it. This is the principle of least privilege (CIS Control 5 and 6, and NIST SP 800-53 control AC-6). Give people the minimum access they need, and give IT staff a separate admin account used only for admin tasks.

Remove local admin rights from daily-use accounts.
Create a separate admin account (for example, jlee-admin) with MFA, and never use it for email or browsing.
Restrict file share permissions by group: the Sales group should not have write access to \\fileserver\Finance.
Place guest Wi-Fi, IoT devices (cameras, printers, smart TVs), and staff computers on separate VLANs.
Disable RDP exposure to the internet. CISA and the FBI have repeatedly named exposed RDP as a leading ransomware entry point; if remote access is needed, use a VPN with MFA.

Check for exposed RDP and unnecessary open ports from the outside, and block inbound RDP at the Windows firewall for good measure:

# From a machine outside your network, scan your public IP for common risky ports
nmap -Pn -p 22,23,445,3389,5900 203.0.113.25

# Expected safe result: all ports shown as 'filtered' or 'closed'
# PORT     STATE    SERVICE
# 3389/tcp filtered ms-wbt-server
# 445/tcp  filtered microsoft-ds

# Block inbound RDP on a workstation
New-NetFirewallRule -DisplayName "Block inbound RDP" -Direction Inbound `
  -Protocol TCP -LocalPort 3389 -Action Block -Profile Any

# Find local administrators on this machine
Get-LocalGroupMember -Group "Administrators"

Block Phishing with Email Filtering and Staff Training

Phishing remains a leading way ransomware gets in, either through a malicious attachment or a fake login page that steals credentials; CISA's #StopRansomware Guide lists it among the top three vectors, and Verizon's DBIR consistently counts phishing among the leading initial access actions. Combine technical filtering with short, regular training.

First, make sure your domain has SPF (RFC 7208), DKIM (RFC 6376), and DMARC (RFC 7489) set up so attackers cannot easily spoof your company name. Google and Yahoo have also required these for bulk senders since 2024, so they help deliverability too. Check your current records:

dig +short TXT example-accounting.com | grep spf
# "v=spf1 include:spf.protection.outlook.com -all"

dig +short TXT _dmarc.example-accounting.com
# "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example-accounting.com; pct=100"

dig +short CNAME selector1._domainkey.example-accounting.com
# selector1-example-accounting-com._domainkey.contoso.onmicrosoft.com.

Then turn on attachment and link protection in your email platform (Defender for Office 365 Safe Attachments and Safe Links, or Google Workspace's enhanced pre-delivery scanning) and block risky file types such as .iso, .js, .vbs, and macro-enabled Office files from external senders. Microsoft has blocked macros in files downloaded from the internet by default since 2022, which pushed attackers toward ISO and other container files, so blocking those matters.

Run a 20-minute training session each quarter using real examples from your own inbox.
Teach three checks: Is the sender expected? Is the request urgent or unusual? Does the link domain match the real company?
Add a 'Report Phish' button in Outlook so reporting takes one click.
Run a simulated phishing test twice a year, and treat clicks as a learning opportunity, not a reason for discipline.
Set a rule for payment changes: any request to change bank details is confirmed by phone using a number already on file.

Write a One-Page Incident Response Plan with Contact List

During an attack, people panic and make poor decisions. NIST SP 800-61 Rev. 3 and CISA's guide both call for a documented, rehearsed response plan. A one-page plan, printed and stored offline, tells everyone what to do. Print it because your email and file server may be unavailable.

RANSOMWARE RESPONSE PLAN - Acme Accounting (v1.2, reviewed 2026-09-01)

1. STOP: Unplug network cable / turn off Wi-Fi on the affected PC. Do NOT power off unless you cannot disconnect it.
2. CALL (in this order):
   - Incident lead: Dana Ortiz, 555-0142 (backup: Marcus Lee, 555-0177)
   - IT provider: BrightNet Support, 555-0100 (24/7 line)
   - Cyber insurance: Hartwell Mutual claims line, 800-555-0190, policy #CY-482913
   - Outside counsel: Rivera & Kim LLP, 555-0155
3. DO NOT: pay anything, delete files, reboot servers, or email the attacker.
4. PRESERVE: Photograph the ransom note. Note the time, user, and what they were doing.
5. COMMUNICATE: Use personal phones/group text, not company email, until cleared.
6. RESTORE: Only from verified clean backups, approved by the incident lead.
7. REPORT: FBI IC3 (ic3.gov) and CISA (cisa.gov/report). Notify clients if their data was affected.

Critical systems restore order: 1) Firewall/Internet 2) Domain/Identity 3) File server 4) QuickBooks 5) Workstations
Backup admin console: backups.acme-example.com (MFA device in safe, Office 2)

Also check your cyber insurance policy now. Many insurers require you to call them before hiring a responder or restoring systems, and some provide a breach coach and forensic team at no extra cost. Walk through the plan in a 30-minute tabletop exercise once a year, using CISA's free Cyber Security Evaluation Tool or its tabletop exercise packages.

Isolate Infected Devices Immediately If an Attack Occurs

Speed matters. Ransomware can spread to network shares within minutes. CISA's guide says to disconnect affected systems from the network first, and to power them down only if you cannot disconnect them, because shutting down destroys volatile memory that may hold evidence useful for investigators and, in some cases, encryption keys.

Unplug the Ethernet cable and turn off Wi-Fi on any machine showing a ransom note, renamed files (for example, invoice.xlsx.locked), or unusual slowdowns.
Disconnect the file server and NAS from the network if encrypted files are appearing there.
Disable the affected user's account and reset passwords for any account that signed in on that machine.
Take backups offline: unplug external drives and disable backup jobs so they are not overwritten with encrypted data.
If you have an EDR tool, use its 'isolate device' function to quarantine remotely (Microsoft Defender for Endpoint, CrowdStrike, and SentinelOne all offer this).

# If you cannot reach the machine physically, disable its network adapters remotely
Get-NetAdapter | Where-Object Status -eq 'Up' | Disable-NetAdapter -Confirm:$false

# Disable a compromised Active Directory account
Disable-ADAccount -Identity "jsmith"

# Microsoft 365: revoke sessions and block sign-in for the user
Connect-MgGraph -Scopes "User.ReadWrite.All"
Revoke-MgUserSignInSession -UserId jsmith@example-accounting.com
Update-MgUser -UserId jsmith@example-accounting.com -AccountEnabled:$false

Report the Attack and Restore from Clean Backups

Once the spread is contained, report the incident. In the US, file a report with the FBI's Internet Crime Complaint Center (ic3.gov) and CISA (cisa.gov/report). The FBI and CISA discourage paying ransoms: payment does not guarantee you get your data back, it funds further attacks, and it can mark you as a willing payer. Payment can also carry legal risk, since the US Treasury's OFAC has warned that paying a sanctioned ransomware group can violate sanctions regulations. Depending on your industry and location, you may also have legal duties to notify affected clients, regulators, or state attorneys general within a set window (all 50 US states have breach notification laws), so involve your attorney early.

Do not restore onto machines that may still be compromised. Rebuild or reimage the infected systems first, change all relevant passwords and keys, and then restore data from a backup taken before the infection began. Work out the likely start date from logs and file timestamps, because the attacker may have been inside for days before encrypting.

# Find the oldest encrypted file to estimate when encryption began
find /srv/clients -name "*.locked" -printf '%TY-%Tm-%Td %TH:%TM %p\n' | sort | head -5

# Pick a snapshot from before that time
restic -r s3:s3.us-west-002.backblazeb2.com/acme-backups snapshots

# Restore snapshot a1b2c3d4 to a freshly built server
restic -r s3:s3.us-west-002.backblazeb2.com/acme-backups \
  restore a1b2c3d4 --target /srv/clients

# Scan restored data before reconnecting users
clamscan -r --infected /srv/clients

Bring systems back in the order listed in your plan, starting with the firewall and identity systems, then file storage, then workstations. Monitor closely for several days after restoration for signs that the attacker still has a foothold, such as unexpected logins, new scheduled tasks, or new admin accounts.

Review What Happened and Close the Gaps

Within two weeks of recovery, hold a blameless review with everyone involved. NIST SP 800-61 calls this the 'lessons learned' phase and treats it as a required part of incident handling. The goal is to find what failed and fix it, not to find someone to blame. If staff fear punishment, they will hide the next incident.

How did the attacker get in: phishing, stolen password, unpatched device, exposed remote access?
How long were they inside before encryption, and what did they touch?
Which defenses worked, and which did not? Did MFA, EDR, or backups behave as expected?
How long did restoration actually take compared with your estimate?
What data was exposed or stolen, and who needs to be notified?
What are the top three fixes, who owns each, and what is the deadline?

Update your inventory, incident plan, and contact list with what you learned, and schedule your next restore test and training session on the calendar. A realistic target for a small business is to complete the backup, MFA, and patching steps in the first 30 days, then work through endpoint protection, segmentation, and email defenses over the following 60. Each layer you add makes a successful attack less likely and a recovery faster.