Ransomware is a business continuity problem with a security cause. The goal is not only to stop attackers getting in, but to make sure that if they do, you can recover without paying. Use this checklist to find your gaps.
Prevent initial access
- MFA on everything internet-facing. Email, VPN, remote desktop and admin portals. Stolen passwords are the most common way in.
- Patch internet-facing systems within days. Firewalls, VPN gateways and web servers are scanned by attackers constantly.
- Filter email properly. Attachment sandboxing, link analysis and impersonation detection stop most phishing.
- Close remote desktop to the internet. Put RDP behind VPN or zero-trust access.
Detect and contain
- Deploy EDR on every endpoint and server. Behavioural detection catches the tools attackers use before encryption starts.
- Centralise logs. Firewalls, domain controllers and endpoints should feed a SIEM so suspicious patterns are correlated.
- Segment the network. A compromised laptop should not be able to reach backup servers or domain controllers.
- Limit privileged accounts. Vault admin credentials, remove local admin rights and monitor privileged sessions.
Recover without paying
- Follow 3-2-1-1-0. Three copies, two media, one offsite, one immutable or offline, zero errors on verification.
- Separate backup credentials. Backup systems should not use domain admin accounts that attackers can steal.
- Test restores quarterly. Know how long it takes to bring critical systems back, in hours, not hope.
- Rehearse the incident. Run a tabletop exercise: who decides, who communicates, who calls the insurer, who reports to CERT-In.
How to score yourself
Give yourself one point for each control fully in place. Nine or more is a strong position. Between five and eight, prioritise backups and MFA first. Below five, treat this as urgent.
In India, CERT-In directions require reporting of specified cyber incidents within six hours of noticing them. Make sure your incident plan includes who does this.
Next steps
If you want an independent view, our risk assessment checks these controls with evidence, and our backup and disaster recovery team can design immutable, tested recovery.