Ransomware: What It Is and How Small Businesses Can Protect Themselves

You arrive at work and open a document. Instead of your file, a message appears: your files have been locked, and you must pay to get them back. Every computer in the office shows the same message. Customer records, invoices, accounts and photographs are all out of reach.

This is ransomware, and it is one of the most damaging threats to businesses of every size. Small organizations are not too small to be targets. They are often chosen because they are less protected.

This post explains what ransomware is, how it gets in, how to reduce your risk with practical steps and what to do if the worst happens.

What ransomware is

Ransomware is malicious software that locks or scrambles your files, or your whole computer, so that you cannot use them. The criminals then demand money, usually in a hard-to-trace form, in exchange for a key to unlock them. Some also steal copies of your data first and threaten to publish it.

Paying is no guarantee. Some victims pay and never get their files back, and paying marks you as someone who will pay again.

How it gets in

Understanding the usual routes makes defence easier.

Phishing emails and messages. A convincing email with an attachment or link, perhaps pretending to be an invoice, a delivery notice or a message from a boss. One click is enough.

Unpatched software. Old versions of operating systems, programs and website software contain known weaknesses that criminals scan for.

Weak remote access. Remote desktop tools or logins protected by simple passwords and no second step are an open door.

Infected downloads. Cracked software, fake apps and files from unknown websites often carry hidden malware.

Infected USB drives and shared devices.

Stolen passwords. Passwords reused from other breaches are tried on your accounts.

Defence 1: Backups that ransomware cannot reach

This is your safety net. If you have a recent, clean backup, ransomware becomes an expensive nuisance instead of a catastrophe.

Follow the 3-2-1 idea: three copies of important data, on two kinds of storage, with one copy kept away from your network. Critically, at least one backup must be offline or otherwise protected, because ransomware tries to lock connected drives and cloud folders too. Test restoring regularly.

Defence 2: Keep everything updated

Turn on automatic updates for computers, phones, routers and programs. Remove software you no longer use. If you run a website, keep its software and plugins current. Most attacks use weaknesses that already have fixes available.

Defence 3: Protect logins

Use strong, unique passwords and a password manager. Switch on two-step login for email, remote access, cloud storage, banking and admin accounts. Do not share logins between staff. Remove accounts of people who leave.

Defence 4: Be careful with email and downloads

Train yourself and your staff to pause before clicking. Check the sender's real address. Be suspicious of urgent requests, unexpected attachments and links asking you to log in. Do not open files you were not expecting. Install software only from official sources.

Defence 5: Limit what each person can do

Staff should not use administrator accounts for everyday work. Give each person access only to what they need. If one account is compromised, the damage is smaller.

Defence 6: Use security software and filters

Install reputable antivirus or security software, keep it updated and use the built-in protections in your operating system. Spam filtering on email, and web filtering where possible, block many threats before anyone sees them.

Defence 7: Secure your network

Change default passwords on routers, use strong Wi-Fi security, keep guest devices on a separate network and turn off remote access you do not use.

Defence 8: Train your people and write a plan

Technology fails when people are not prepared. A short training session once or twice a year, covering phishing, passwords and what to do when something looks wrong, is worth more than expensive tools nobody understands.

Write a one-page plan: who to call, where the backups are, which systems are most important and what to do first.

If you are hit

Act calmly and quickly.

Disconnect the affected computers from the network and from Wi-Fi immediately, to stop it spreading. Do not turn off the power unless advised, because that can sometimes destroy useful evidence.

Do not pay in a panic. Authorities generally advise against paying, because there is no guarantee and it encourages more attacks. Weigh your options with expert advice.

Identify what was affected, and check your backups to see whether you can restore.

Change passwords, starting with email and admin accounts, from a clean device.

Tell your IT support or a trusted professional, your hosting provider if a website is involved and, where appropriate, the police or relevant authorities.

If customer or student data was involved, be honest with those affected so they can protect themselves.

Rebuild from clean backups on cleaned machines, and find out how the attackers got in so you can close the hole.

What to do this week

Check that you have a recent backup and that at least one copy is offline or away from the network. Turn on automatic updates. Turn on two-step login for email and admin accounts. Tell your team about suspicious attachments. Write down your plan. None of this requires a large budget.

Need help?

I help businesses and schools set up sensible protection: backups, updates, secure logins, safe websites and clear procedures. Contact me through the contact page, or call or WhatsApp me on +231 777 810 466. And if you know a business that keeps all its files on one computer, share this post with them.