How to prevent ransomware attacks on your endpoints

How ransomware attacks unfold

Most ransomware incidents follow a similar pattern, and every stage is a chance to stop it:

The NCSC's guidance on mitigating malware and ransomware attacks recommends a defence-in-depth approach for exactly this reason: assume some malware will get in, and put layers in place so you have several chances to detect and stop it before it causes real harm. Its four actions are to make regular backups, prevent malware being delivered and spreading, prevent malware running on devices, and prepare for an incident. The steps below follow the same order of thinking, with a focus on what you do on laptops, desktops and servers.

10 steps to prevent ransomware attacks

1. Know every device you have. You cannot protect what you cannot see. Compare your asset list with the devices reporting to your security console and close the gap, including servers, virtual machines and remote laptops. Our guide to what an endpoint is helps you list them.
2. Patch, starting with what faces the internet. The NCSC notes that ransomware is increasingly deployed through exposed services such as Remote Desktop Protocol and unpatched remote access devices. Prioritise firewalls, VPNs and remote access first, then operating systems, browsers and office apps. Our patch management process guide covers how to run this on a schedule, and replace software that is no longer supported.
3. Close or lock down remote access. Disable Remote Desktop where it is not needed, put MFA on every remote access route and every cloud service, and give remote users low-privilege accounts. A zero trust approach to devices checks a device is healthy before it is allowed in.
4. Remove standing local admin rights. Ransomware that runs as an everyday user can do far less damage. Give people a way to elevate for approved tasks instead, and keep admin accounts away from email and web browsing. See endpoint privilege management.
5. Control what is allowed to run. Application allowlisting, restrictions on macros and scripting, and disabling auto-run for removable media all stop common ransomware loaders from starting. Start in audit mode, then enforce. See application whitelisting and USB device control, and build them into your endpoint hardening baseline.
6. Run EDR with behavioural anti-ransomware, and make sure someone acts on it. Modern ransomware operators use legitimate tools, so signature-based antivirus alone can miss them. Endpoint detection and response watches behaviour, can isolate a device and kill processes, and records what happened. An alert at 2am only helps if someone responds, which is why organisations without their own out-of-hours cover often add a vendor-run managed detection and response service. If you are weighing up EDR against what you already run, see EDR vs antivirus.
7. Add rollback and a dedicated anti-ransomware layer where it fits. Several platforms can undo ransomware damage on the device itself (see the table below), and some organisations add a specialist anti-ransomware agent beside their existing EDR. Turn on tamper protection so attackers cannot simply switch your security off.
8. Keep offline backups and test restores. The NCSC calls up-to-date backups the most effective way of recovering from a ransomware attack. Keep at least one copy offline or in a cloud service designed to protect earlier versions, protect backup admin accounts with MFA, and test that you can restore. Forever Group offers cloud backup, and our sister site covers cloud backup options.
9. Train people to spot the first move. Phishing and social engineering are a common way in. Short, regular training and simulated phishing help staff recognise and report suspicious messages. See ransomware awareness training on our sister site.
10. Plan and rehearse your response. Decide in advance who isolates devices, who talks to customers and regulators, how you would rebuild from offline backups, and how you will respond to a ransom demand or a threat to publish data. Keep the plan available offline and exercise it. The NCSC offers a free online Exercise in a Box tool to help.

Ransomware rollback and anti-ransomware in the platforms we supply

Ransomware rollback means different things in different products: some restore individual files from on-device copies, others return the whole device to its state before the attack. These are the capabilities each vendor describes in its own material; which edition or bundle you need is confirmed at quote.

Two cautions. Rollback works on the device and depends on local copies or snapshots that ransomware tries to destroy, so it complements backups rather than replacing them. And no single layer stops every attack, which is why the NCSC recommends defence in depth. Compare licensing for these and other options in anti-ransomware software on our licensing site.

What to do if ransomware gets through

If you suspect ransomware on a device, speed matters, but so does not making things worse:

• Isolate affected devices from the network, using your EDR console's isolation if you have it, and avoid wiping or rebuilding them until you have preserved what investigators may need
• Follow your response plan and bring in incident response help early; the NCSC runs a commercial Cyber Incident Response scheme in which certified companies support affected organisations
• Reset credentials that may have been exposed, starting with admin and remote access accounts
• Check backups are clean before restoring, because ransomware may have been present for some time and copied into backups
• Report it to the NCSC through report.ncsc.gov.uk, which also encourages reporting to the Report Fraud service, and consider whether you must notify the data protection regulator (see endpoint security compliance)

On paying, the NCSC is clear that law enforcement does not encourage, endorse or condone ransom payments. If you pay, there is no guarantee you will get access to your data, your computers will still be infected, you will be paying criminal groups and you are more likely to be targeted in future. Planning for recovery without paying is the safer position.

Common gaps in ransomware defences

When organisations review their ransomware readiness, these are weaknesses worth checking for first:

• EDR installed but nobody watching: alerts pile up out of hours with no one to triage or isolate a device
• Servers left on a lighter policy, or excluded from protection, because of performance worries that nobody revisited
• Backups reachable from the main network, with the same admin credentials, so attackers can delete them first
• Everyday accounts with local admin rights, often left over from a one-off software install
• Unsupported operating systems still running a line-of-business application, without extra isolation
• No rehearsed plan, so the first time anyone reads it is during an incident

Some of these can be closed by changing how tools you already own are configured; others need an extra layer or a service. Our endpoint security best practices checklist covers the wider programme.

How we help

We supply several endpoint security platforms, so we can look at your ransomware defences without pushing one product. We can:

• Review your current endpoint protection, EDR coverage, admin rights, patching and backup set-up against the NCSC's ransomware guidance
• Recommend where rollback, a dedicated anti-ransomware layer or a vendor-run MDR service would add the most, with pricing confirmed at quote
• Help plan and roll out EDR, application control and privilege management in stages
• Point you to backup, training and incident response services across Forever Group

Contact us to talk through how to prevent ransomware attacks on your devices.