iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ransomware resilience is an operational capability, not a single security product. Build it in this order: identify the services you must recover, prevent unauthorized access, limit how far an intruder can move, maintain offline encrypted backups that you have actually restored in tests, prepare people and decisions, and follow a rehearsed response plan when an attack occurs.
CISA’s joint #StopRansomware Guide, developed with MS-ISAC, the FBI and NSA, defines ransomware this way: “Ransomware is a form of malware designed to encrypt files on a device, rendering them and the systems that rely on them unusable.” Encryption is only part of the danger. Attackers may also steal data, disable recovery tools, abuse administrator credentials and monitor internal communications.
Start with the services your organization cannot afford to lose
Protection decisions are easier when they begin with business impact rather than with a list of products. Create and maintain an inventory of logical and physical assets, then map the systems, identities, networks, suppliers and data stores each critical service depends on.
Classify critical services and dependencies
- List essential services such as identity, email, finance, customer operations, manufacturing, clinical systems or public-facing applications.
- For each service, record the servers, cloud resources, databases, endpoints, administrator accounts, network paths and external providers required to operate and restore it.
- Assign an owner who can set recovery priority and approve acceptable downtime and data loss.
- Keep network diagrams, asset records and recovery documentation securely available, including offline copies that remain usable if normal systems are unavailable.
This inventory should be reviewed after major technology or organizational changes. An unknown dependency can turn a successful restore of one server into an unusable application.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Make backups a tested recovery system
“We have backups” is not the same as “we can recover.” Ransomware can reach connected backup repositories, encrypt them, delete them or compromise the credentials used to administer them. CISA recommends offline, encrypted backups of critical data and regular tests of their availability and integrity in a disaster-recovery scenario.
Choose an architecture deliberately
| Approach | What it contributes | Decision points |
|---|---|---|
| Offline encrypted copies | Separates recovery data from systems an attacker can reach during an intrusion. | Define how copies are disconnected, who can retrieve them, how keys are protected and how quickly they can be brought into a clean recovery environment. |
| Online backups or snapshots | Can support fast operational recovery and frequent restore points. | Treat them as an additional layer, not the only copy; verify that ransomware cannot use ordinary administrative credentials to alter or erase them. |
| Immutable storage | Can prevent modification or deletion during a configured retention period. | Immutability has cost, configuration and compliance implications. Confirm retention, expiration, legal holds, access controls and restoration procedures rather than assuming it is universally appropriate. |
Build the recovery package
- Identify the data sets and configuration records required for each critical service, including identity, network and security settings.
- Encrypt backup data and protect encryption keys separately from ordinary administrator credentials.
- Keep at least one recovery copy offline or otherwise inaccessible from the production attack path. Document the physical or logical process for retrieving it.
- Preserve golden images, installation media, license information, infrastructure-as-code, scripts and the software versions needed to rebuild systems. A data backup is insufficient if the platform that reads it cannot be recreated.
- Use separate, tightly controlled accounts for backup administration. Review who can change retention, delete copies or alter recovery settings.
Test restoration, not just backup completion
Schedule tests that simulate a disaster-recovery scenario. Select representative files and complete critical systems, restore them into an isolated environment, verify application behavior and confirm that data is complete and usable. Measure the elapsed time, manual work, dependencies and decisions required. Record failed restores and correct them before the next exercise.
Test the offline retrieval process itself: personnel should know where recovery materials are stored, how access is authorized and how keys are obtained when normal identity services are down. Retest after changes to backup software, storage, cloud accounts, network design or critical applications.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect privileged and critical access
Compromised credentials are a common path to both initial access and rapid spread. Apply stronger controls to email, VPN, remote administration, cloud consoles, backup systems and every account that can reach critical services.
Require phishing-resistant MFA where it matters most
CISA recommends phishing-resistant multifactor authentication, particularly for email, VPN and accounts with access to critical systems. Passwordless MFA based on a cryptographic key is one implementation example. A FIDO2-compatible hardware security key can be considered when the organization’s identity provider and applications support it, but a key is only one element of an identity-control program.
- Inventory services that allow, enforce or do not support phishing-resistant MFA.
- Prioritize administrators, help-desk staff, executives, remote-access users and backup operators.
- Enroll users before enforcement, establish secure recovery procedures and maintain spare authenticators under controlled custody.
- Escalate systems that cannot enforce MFA or users who remain unenrolled; document the compensating controls and a remediation date.
Reduce the value of every stolen account
- Apply least privilege: grant only the permissions needed for a person, service or automation to perform its role.
- Separate ordinary user accounts from privileged administration accounts and require stronger authentication for elevation.
- Review group membership, service-account use, dormant accounts and third-party access on a defined schedule and after personnel changes.
- Limit administrator access to backup consoles, domain controllers, hypervisors, security tooling and remote-management platforms.
- Harden cloud and remote-management access, including conditional access, administrative interfaces, API keys and exposed management ports.
Log authentication, privilege changes, remote sessions and backup-administration events. Logs should be protected from alteration and retained long enough to support detection and investigation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Segment the environment to limit lateral movement
Network segmentation helps contain an intrusion by limiting which systems can communicate. It is not a substitute for identity controls: a user can defeat a poorly designed boundary by connecting devices across segments, and an over-permissive firewall rule can make separate networks function as one.
Design boundaries around risk
- Separate user workstations, servers, backups, identity services, management interfaces, development environments, production systems and high-impact operational technology where appropriate.
- Permit only the protocols and paths each service requires; deny unnecessary east-west traffic.
- Place backup administration and recovery networks behind separate controls from ordinary production administration.
- Review firewall rules, VPN routes, trust relationships and remote-access paths whenever a system or supplier changes.
Maintain current diagrams showing trust boundaries, critical dependencies and emergency isolation points. Store an offline copy and ensure staff know which switch, firewall or cloud control can disconnect an affected segment.
Prepare people, authority and communications before an incident
An incident becomes slower and more damaging when nobody knows who can isolate systems, approve notifications, contact responders or authorize restoration. Maintain an incident-response plan and a communications plan with named roles, alternates, notification procedures and contact methods that work when corporate email or collaboration tools are compromised.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Define the decision structure
- Incident lead: coordinates technical, business and legal decisions.
- Technical response: identifies affected systems, isolates them, preserves evidence and directs eradication and recovery.
- Business owners: set service priorities and approve operational trade-offs.
- Communications: manages employee, customer, supplier, regulator and media messaging through approved channels.
- Legal, privacy and compliance: assess notification and reporting duties based on the organization’s jurisdictions and the facts of the incident.
- Executive authority: resolves conflicts over shutdowns, emergency spending, service priorities and external engagement.
Keep contact lists available offline and maintain an out-of-band method such as prearranged phone numbers or alternate messaging. Attackers may monitor normal organizational activity, so avoid relying exclusively on compromised systems for coordination.
Exercise the plan
Run tabletop exercises that start with a realistic alert and require participants to make decisions, not merely discuss policy. Include loss of email, unavailable identity services, uncertain scope, a suspected data breach and pressure to restore quickly. CISA provides a Ransomware Readiness Assessment and tabletop-exercise resources that can structure these sessions.
Recommended Free Tools
After each exercise, assign owners and deadlines for gaps involving access, backups, diagrams, contacts, contracts or communications. An unclosed action is a known risk, not a completed control.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Use a coordinated response when ransomware is suspected
Follow the approved incident-response plan and involve qualified responders. Do not improvise large-scale shutdowns without considering safety, operational continuity and evidence preservation.
- Confirm and scope the signal. Record ransom notes, unusual encryption, disabled security tools, suspicious accounts, affected hosts, timestamps and indicators. Determine which systems and subnets may be involved.
- Isolate affected systems. Disconnect compromised hosts and accounts using the least destructive effective method. If multiple systems or subnets appear affected, taking the network offline at the switch level may be a containment option described by CISA. Coordinate the action so one team does not reconnect systems another team is isolating.
- Move coordination out of band. Use trusted phones or alternate channels when email, chat or identity services may be monitored or compromised.
- Preserve evidence where possible. Capture relevant logs, memory or disk images, ransom notes and system details according to the response plan and legal guidance. Powering down can be a fallback when disconnection is impossible, but it may destroy volatile evidence; make that trade-off with incident responders.
- Engage stakeholders and authorities. Notify internal leadership, insurers, specialist responders and technology providers as defined in the plan. CISA’s guide identifies CISA, the FBI and the Internet Crime Complaint Center among possible contacts; use the channels appropriate to your organization and location.
- Assess data exposure. Determine whether information was accessed or exfiltrated, not only whether files were encrypted. Follow the organization’s notification plan and applicable legal or contractual requirements if a breach occurred.
- Eradicate the access path. Reset or disable compromised credentials, remove persistence, patch exploited weaknesses, rebuild affected systems and verify that management and backup accounts are trustworthy before reconnecting anything.
- Restore in business priority order. Rebuild clean systems and restore from offline encrypted backups. Start with identity, networking and other dependencies, then recover the highest-priority services. Validate each system before it reconnects to production.
- Monitor for reinfection. Increase logging and alerting, review privileged activity and keep restored systems in controlled segments until the response team confirms that the intrusion has been removed.
- Capture lessons learned. Document the initial access, scope, control failures, recovery duration, decisions and remaining risks. Update inventories, plans, configurations and training.
Adapt the program to organizational size and risk
| Organization profile | First priorities | Next maturity step |
|---|---|---|
| Small organization with limited IT staff | Inventory essential services; enforce MFA on email, remote access and administration; establish offline encrypted backups; test one complete restore; keep an offline contact list. | Use managed expertise where necessary, separate backup administration, segment critical systems and run a tabletop exercise. |
| Mid-sized organization | Assign service owners; formalize least privilege and access reviews; create recovery tiers; centralize protected logging; document network and cloud dependencies. | Automate restore testing, expand phishing-resistant MFA, rehearse multi-subnet isolation and validate supplier response obligations. |
| Large or highly regulated organization | Map business services to identities, applications, facilities and suppliers; maintain multiple recovery environments; enforce strong administrative separation; integrate legal, privacy and executive decision paths. | Exercise coordinated enterprise recovery, test regional or provider failures, measure recovery objectives and validate reporting workflows across jurisdictions. |
These are sequencing recommendations, not substitutes for a formal risk assessment. The right control strength depends on the sensitivity of data, operational consequences, exposure to the internet, supplier access, available staff and applicable obligations.
Common weaknesses that make ransomware recovery fail
- Backups are online but untested: Add offline copies and scheduled full restoration exercises.
- The backup console shares domain-admin credentials: Separate administration, restrict access and review privileged activity.
- MFA is enabled only for ordinary users: Extend phishing-resistant MFA to administrators, remote access, email and critical cloud services.
- Segmentation exists only on a diagram: Test real traffic paths, remove unnecessary trust and train staff not to bridge networks.
- Golden images are obsolete: Rebuild them after major patches and retain the software and configuration materials needed to use them.
- The response plan depends on corporate email: Maintain tested out-of-band communications and offline contact information.
- Restoration begins before containment: Verify that attacker access, persistence and compromised credentials have been addressed or restored systems may be reinfected.
- Legal and notification decisions are improvised: Predefine escalation paths and obtain jurisdiction-specific advice; requirements vary and should be assessed from the facts of the event.
Maintain the program as an operating cycle
At least annually, and after significant changes or incidents, review the asset inventory, service priorities, network diagrams, privileged access, MFA coverage, backup isolation, restoration results, contact lists and communications procedures. Track measurable evidence such as the percentage of critical accounts using phishing-resistant MFA, the date and outcome of the last restore test, the age of recovery images, unresolved segmentation exceptions and time required to retrieve offline backups.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The current CISA #StopRansomware materials should be checked for updates before adopting version-specific procedures. A September 2023 guide landing page and a PDF path dated March 2025 have both been associated with the guidance; confirm the current publication and any revised contact information when maintaining your plan.
The practical standard is simple: an attacker should have fewer ways in, less ability to move, fewer privileges to abuse and no easy path to destroy every recovery copy. Your organization should know who makes decisions, how systems are isolated, how evidence is preserved and how clean services are restored before a ransom note appears.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
