Ransomware protection: 7 measures that actually work

Ransomware is no longer just for large corporations. Slovenian small and medium-sized enterprises are the #1 target today because they have enough money for a ransom but lack a large internal IT team. This article presents 7 concrete measures for ransomware protection that stop the vast majority of attacks – without the marketing hype.

1. MFA for EVERYONE, not just administrators

Most successful attacks start with the theft of a user password (phishing, password reuse). Multi-factor authentication (MFA) stops 99% of these attacks. Basic hygiene is: MFA for Microsoft 365, VPN, RDP, administrative access – with no exceptions.

2. Backup using the 3-2-1 rule (and verified recovery)

Backup 3-2-1 means: 3 copies of data, on 2 different media, 1 copy offsite. For ransomware, two additional requirements are key:

• Immutable backup: a copy that an attacker (not even as an administrator) can delete or encrypt.
• Regular recovery testing: at least once a month, verify that recovery is actually possible. A backup that you have never restored does not exist.

3. Network segmentation with VLANs and firewalls

A flat network (everyone in the same subnet) means ransomware infects everything within hours. Segmentation via VLANs (users, servers, guests, IoT, cameras) drastically limits the damage. For Slovenian SMEs, this is achievable without huge investments.

4. EDR instead of classic antivirus

Classic antivirus looks for known signatures. Modern ransomware bypasses them in hours. EDR (Endpoint Detection & Response) – e.g., Microsoft Defender for Business, SentinelOne, CrowdStrike – observes process behavior and stops encryption after the first few files.

5. Regular system patching

Critical vulnerabilities (Exchange, VPN devices, hypervisors) are the most common entry points. Establish a patching cycle:

1. Critical vulnerabilities (CVSS 9+): within 72 hours.
2. Other updates: within 2 weeks.
3. Firmware on network equipment: quarterly.

6. Limiting administrative privileges

The principle of least privilege: no one works as an administrator on a daily basis. Use a separate account (and a dedicated PC/PAW) for administrative tasks. Once an administrative device is infected, it is over.

7. Preparing a response plan (and practice)

All the prevention in the world does not eliminate risk to zero. Therefore, prepare a written plan: who notifies whom, how to isolate infected systems, who the legal/PR contact is, when to notify the Information Commissioner. Conduct a drill at least once a year.

Let's check your ransomware readinessWe perform a quick state assessment and prepare a hardening plan within 2 weeks.

Should we pay the ransom if it happens?

The recommendation of European security agencies (ENISA) and the Slovenian SI-CERT is: NO. Payment does not guarantee recovery, it finances new attacks, and marks you as a 'prepared target' for next time.

How often should backup recovery be tested?

At least once a month a partial recovery (a few files/VMs), and at least once a year a full recovery drill of a critical system (e.g., ERP).

Do insurance companies cover the damage?

Cyber insurance exists in Slovenia, but insurance companies require proof of basic security measures (MFA, backup, EDR). Without these, the policy will not pay out.

How much does it cost to implement all 7 measures?

For an SME with 20–50 employees, a sensible budget is 3,000–8,000 EUR for the initial setup, followed by annual operating costs (EDR licenses, backup) of approximately 1,500–3,000 EUR. Significantly less than a single ransomware incident.