Ransomware Readiness: 10 Things to Do Before the Attack Happens

Ransomware is malicious software that encrypts files and demands payment to restore access; in modern attacks, data exfiltration and extortion threats are also added prior to encryption. Target selection is not limited to large enterprises; thanks to automation, businesses of every scale can be targeted. In this article, we explain the preparations that will make a difference when an attack occurs, in order of priority. This article is for general informational purposes; if an incident is underway, competent authorities and an expert incident response team should be consulted.

1. Immutable and offline backup

Attackers target backups first. A backup is not a backup if it is accessible on a network share with the same credentials as the production system. The classic 3-2-1 rule still applies: at least three copies, two different media, one copy in a different location. Modern addition to this: at least one copy must be immutable or offline. Object lock features in object storage or physically separated disks serve this purpose.

2. Restore drill

What is valuable is not the backup taken, but the backup restored. At regular intervals (e.g., every quarter), critical systems must be restored from backup to a separate environment and verified to be operational. This drill answers two questions: how long recovery takes (RTO) and how much data we lose (RPO). Without knowing these two values, one cannot say "we are ready".

# Example: Restoring and verifying a PostgreSQL backup to a separate environment
pg_restore --clean --if-exists -d restore_test /backups/app_2026-10-01.dump
psql -d restore_test -c "select count(*) from invoices;"   # compare with expected count

3. Privilege hygiene

Ransomware spreads as far as the privileges of the account it compromises. Not using administrator accounts for daily tasks, removing local administrator rights, defining service accounts with least privilege, and implementing multi-factor authentication (MFA) significantly reduce the speed of propagation.

4. Network segmentation

In a flat network, the infection of one device means the infection of the entire network. Servers, user devices, the backup network, and IoT devices must be kept in separate segments; only backup traffic should reach the backup server.

5. Patch and exposed service management

Internet-exposed and unpatched services (remote desktop, VPN devices, legacy web applications) are among the most common entry points. An inventory of externally exposed services must be compiled, unnecessary ones disabled, the remaining kept up-to-date, and placed behind MFA.

6. Email and user awareness

Phishing remains the most common starting point. Technical filters are important; however, a culture that makes it easy for employees to report suspicious emails and does not punish the reporter is at least as effective as filters.

In ransomware incidents, there is no guarantee that paying will bring the data back. The only reliable recovery path is a pre-attack and tested backup.

7. Incident response plan: keep it on paper

When systems are locked, you may not be able to access a digital plan. A printed copy should include: who to call (management, IT, legal, insurance, law enforcement and data protection authority if necessary), which systems to isolate first, through which channels communication will be conducted (corporate email may be disabled), and the recovery order.

8. Data leak scenario and notification obligation

If personal data has been leaked, notification obligations may arise under the KVKK in Turkey, the Personal Data Protection Law in the TRNC, and GDPR for EU-linked data; deadlines and procedures vary by legislation. Knowing where which data is kept (data inventory) saves hours at this moment.

9. Monitoring and early warning

Signals such as bulk file modifications, administrator logins at unusual hours, and backup deletion attempts should trigger alerts in the central logging system. An incident noticed early can be confined to a single segment rather than the entire network.

10. Exercise

Conduct a tabletop exercise at least once a year: walk through the scenario "Monday morning the accounting server is encrypted" step-by-step with management and IT. Most organizations discover the gaps in their plan during the first exercise; the place to discover that is the drill, not a real incident.

Frameworks

Moment of incident: what to do in the first hours?

This section does not replace an incident response plan; rather, it outlines the headings it should include.

1. Isolate: Disconnect affected devices from the network (do not shut them down; memory may be important for forensic analysis). Cut the network connection of the backup server.
2. Stop the spread: Terminate sessions of suspicious accounts, change passwords, temporarily disable remote access.
3. Record: When it was noticed, which systems were affected, what the ransom note says; take screenshots and timestamps.
4. Report: Management, legal, insurance, and external experts in your plan. If personal data is affected, evaluate notification deadlines in the legislation with legal counsel.
5. Plan recovery: Restore to a clean environment, from a verified backup, in order of priority. Do not restore over the infected system.

Backup verification: how to make sure it is "clean"?

Attackers sometimes enter the system weeks before encryption; backups taken during this period may contain malware. Therefore, the retention policy must include not only the last few days, but also weekly and monthly points. Restoration is done in an isolated environment and scanned before the system is opened to the network. If the application data (database) backup and system image backup are kept separate, it becomes possible to restore only the data onto a clean operating system; this is often the safest way.

Minimum package for small businesses

• Daily automated backup, weekly and monthly retention points.
• One copy encrypted and off-site, unpayable with production credentials.
• MFA on all accounts; no use of administrator accounts for daily tasks.
• Automatic updates enabled; no externally exposed remote desktop.
• Restore drill every three months; results recorded on a single page.
• Printed contact list and response steps.

This package is not perfect, but it covers the core steps that are decisive in the majority of ransomware incidents.

Insurance and contracts

Cyber insurance policies generally mandate certain minimum precautions (MFA, backup, patching); coverage may be void if precautions are absent. Read the terms with the IT team before renewing the policy. Similarly, liability and response times during an incident must be stated in contracts with software and infrastructure vendors.

Culture: blame-free reporting

An employee who clicks on a phishing email can limit the incident to a single device if they report it immediately; if they hide it out of fear of punishment, it spreads across the network. A culture where the answer to "I clicked, what should I do?" is known by everyone and the person reporting is appreciated is more effective than the most expensive security product.

Final word

The ransomware threat will not disappear; but for a prepared business, this is not a disaster, but a manageable outage. The difference lies in what is done before the attack.

NIST Cybersecurity Framework 2.0 (identify, protect, detect, respond, recover, govern) and ISO/IEC 27001:2022 controls for backup, logging, incident management, and business continuity align with this list. Cy Logic's backup strategy and disaster recovery plan in infrastructure services are mandatory parts of the deployment, not optional.