The Most Important Steps SMBs Can Take to Prevent Ransomware
While small businesses often have more limited budgets and difficulty hiring highly skilled security staff, they are up against the same ransomware threats that large enterprises face. The consequences of a successful attack can also be tougher for SMBs to handle.
Ryan says the key to defending against ransomware attacks is to focus on practical, high-impact steps that deliver real protection without overextending resources. Here are some of the ways SMBs can bolster their cybersecurity posture:
- Don’t go at it alone. “Start by outsourcing where it makes sense, such as partnering with a managed security provider or taking advantage of the built-in protections in cloud and email platforms,” says Ryan.
- Reduce your attack surface. Ryan recommends enforcing multifactor authentication everywhere, closing unused accounts and services, and disabling risky settings such as open Remote Desktop Protocol. Vitor Ventura, security researcher and manager of the EMEA and Asia outreach team at Cisco Talos, adds that it’s essential that MFA be prioritized for high-privileged accounts.
- Automate hygiene. By turning on auto updates and standardizing on a small set of apps and devices, SMBs can better protect their business, says Ryan.
- Plan for failure. SMBs can do this by “testing data restoration from backups at least quarterly and keeping one backup offline or immutable so you can recover without paying a ransom,” Ryan explains.
- Invest in modern, AI-driven endpoint protection. Endpoint protection tools should stop attacks automatically and do not require in-house analysts, says Ryan.
- Keep employee training simple but consistent. “Short phishing refreshers and regular simulations are far more effective than a once-a-year training session,” she adds. “These actions create a practical and achievable path to resilience for any SMB, even with limited resources.”
- Patch internet-facing servers. This should be done regularly to ensure servers have the latest security updates, says Ventura, who recommends that SMBs restrict exposure of internal systems to the internet. “Patch management keeps attackers from exploiting well-known flaws, and automating updates wherever possible helps take the burden off limited IT staff,” adds Ryan.
- Set up network monitoring. “Network monitoring provides early warning by spotting suspicious activity before ransomware can spread, and many managed providers can deliver this as a service if you do not have the expertise in house,” says Ryan.
- Implement defense-in-depth models. “An organization’s diverse network environment results in multiple potential attack surfaces, such as email, web servers, endpoints, etc.,” Ventura explains. “Up-to-date protections must be present on these attack surfaces so that organizations can detect and block intrusions even if initial compromise has been successful.”
Ventura adds that defense in depth, which includes deploying software for detection and blocking of threats across multiple attack surfaces, must be complemented by comprehensive and continuous process-based actions.
“Timely patch management, identity and access control, network segmentation and monitoring, and backup and recovery are imperative to ensure that organizations are protected against proliferation of ransomware across their environments,” he says.
