Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Businesses can reduce the likelihood and impact of ransomware by securing critical accounts, keeping offline encrypted backups that are regularly tested, identifying which systems must be restored first, and rehearsing a response plan. No single control guarantees prevention; the aim is to make intrusion harder and recovery more dependable.
What ransomware can do to a business
Ransomware is malware that encrypts files, making a device—and systems that depend on those files—unusable while attackers demand payment for decryption. Some attacks use “double extortion”: attackers steal data as well as encrypt it, then threaten to publish the stolen information. Other incidents involve data theft and extortion without encryption. Any of these situations can interrupt business processes and make recovery difficult and costly. CISA’s #StopRansomware Guide, developed with MS-ISAC, NSA, and the FBI and revised October 19, 2023, describes these threats.
Build a recovery path before an attack
Keep critical backups offline, encrypted, and tested
CISA’s guidance is direct: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” An offline copy is less exposed to ransomware that can reach systems connected to the production environment. Encryption and access controls help protect the backup itself.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsDo not treat a successful backup job as proof that recovery will work. Test that the required data can be retrieved and that systems can be restored in a realistic recovery scenario. Keep at least one copy disconnected when it is not actively being used for backup. A portable drive can be one destination, but it is not a complete recovery plan by itself.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Choose backup arrangements around your business
There is no single backup pattern that fits every organization. When assessing a design, consider whether copies are offline or otherwise isolated from affected systems, whether they are encrypted and access-controlled, and whether restores have been tested. Also consider how quickly critical services can return and whether a cloud account or vendor shares a failure domain with production systems.
Immutable storage may help prevent copies from being altered, but it can introduce compliance constraints and misconfiguration costs. CISA advises weighing those considerations rather than assuming immutability is automatically the right answer. Map backup choices to the systems, data, and recovery priorities your business actually has.
Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Consider rebuild compatibility
Recovery may involve rebuilding systems from golden images as well as restoring data. CISA notes that rebuilding across different hardware or platforms can create compatibility hurdles, so account for the environment in which each image would need to run.
Reduce the account risks attackers may exploit
Use phishing-resistant MFA on critical access
Enable phishing-resistant multifactor authentication (MFA) for services throughout the business, with particular attention to email, VPNs, and accounts that can reach critical systems. These accounts can provide a path into business operations, so protecting them is a practical priority. CISA also provides MFA guidance for small businesses.
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Limit privileges and review access
Apply least privilege: give people and service accounts only the access needed for their roles. Manage roles and permissions across both on-premises and cloud services, rather than reviewing one environment while leaving another outside the process.
Decide what must come back first
Make an inventory of logical and physical IT assets, then identify the systems and data that matter most to health, safety, revenue, or essential services. Document dependencies between them. A system that appears secondary may be required to restore a more important service, so dependencies should inform recovery order.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Use that inventory to define restoration priorities before an incident. This makes it easier to direct limited recovery effort toward essential operations instead of deciding the sequence under pressure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Agree on the response before an emergency
Maintain a cyber incident-response plan and a communications plan, and exercise them. The plans should address ransomware and breach-notification procedures, identify relevant internal and external responders, and make clear who has authority to make decisions. CISA recommends leadership approval and broad understanding across the chain of command.
Best Value
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
Include the people who may need to coordinate or support a response, such as IT and security staff, leadership, communications, legal counsel, and relevant service providers. CISA’s guide identifies managed and security service providers among potential response stakeholders; the right participants depend on your organization and its arrangements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when ransomware is detected
- Identify and isolate affected systems. Follow the approved response plan and contain systems that appear affected so the incident does not continue to spread.
- Engage the response team. Bring in the internal and external responders identified in your plan, and follow established decision and communications procedures.
- Consider reporting. The plan should cover whether and how to report the incident to CISA or law enforcement, as well as applicable breach notifications.
- Preserve relevant evidence. Avoid actions that could unnecessarily destroy information needed to understand or investigate the incident.
- Restore in priority order. Recover clean systems and data from offline backups, guided by documented business priorities and dependencies.
- Record lessons learned. After the response, document what happened and use the findings to improve the plan, controls, and recovery process.
For additional official materials, see CISA’s StopRansomware resources, including its small-business and ransomware readiness resources.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
