Why ransomware is a question of “when”, not “if”
Ransomware is the most expensive cyberattack scenario for a mid-sized business: all systems stop at once, not just one. The industry has already felt this. Construction, manufacturing and retail companies have become the number one target for extortionists, and the average recovery time after critical systems are encrypted is measured in days, not hours: 5-6 days, according to industry data.
Antivirus and a firewall reduce the likelihood but do not remove it: a third of successful attacks start with stolen credentials and come in through contractors, that is, past your perimeter. So the mature position sounds like this: “we assume an attack will happen, and we prepare recovery in advance”.
Preparation before the attack: 6 lines of defence
- Inventory what is critical. Which systems and data stop the business? Without this list you will try to save everything at once, which means saving nothing.
- Isolated backups. A copy that is reachable from the network gets encrypted along with the original. You need an offline or immutable copy.
- Network segmentation. An attack must not get from accounting to production in one step.
- Access rights. An ordinary employee’s account must not open the doors to all company data.
- An action plan on paper. In the first hours nobody thinks clearly, so you need a ready procedure: what to isolate, whom to call, what to say.
- Workaround processes. How do you take orders and ship goods without IT, at least in emergency mode? Manual procedures are prepared in advance and cost almost nothing: this is organisational work, not a hardware purchase.
Backups that will survive an attack
The main mistake is to check that copies exist instead of checking recovery from them. The working rule is 3-2-1: three copies, on two types of media, one of them outside the main infrastructure and not writable from the working network. And the key question to ask your IT team today: “how many hours does it really take us to restore the main system from the latest copy, and when did we last try it?”
Recovery plan: a realistic RTO, counted in days
Every critical system should have a recovery time objective (RTO) and a clear view of what one hour of its downtime costs. Then the recovery plan turns from wishes into economics: what we bring up first, which resources we keep in reserve, where downtime is tolerable and where every hour costs millions. How to calculate this is covered in the article on the cost of downtime.
Rehearsal: the only honest test
A paper plan lies. The only way to learn the truth is a rehearsal: a run-through of the scenario “ransomware has encrypted everything”, played against a stopwatch. The team works through the first hours in their assigned roles, IT restores a test environment from a real backup, and management makes decisions on the prepared communications. The result is a measured actual recovery time and a list of gaps found without real damage. We run such rehearsals as a separate service, with a scenario, measurement and a report for management. The first hours of an attack are covered step by step in the article on what to do in a cyberattack.
If you need a rehearsal like this together with a backup check and a loss calculation, that is the five-week ransomware readiness check: processes without ERP and CRM, recovery together with your IT team, and findings for the owner.
Frequently asked questions
Should you pay the ransom? It is a bad option: payment does not guarantee decryption, marks you as a target that pays, and in some jurisdictions carries legal risks. The only reliable alternative is recovery from isolated backups.
We have antivirus and a SOC. Is that not enough? That is the first half of protection: reducing the likelihood. The second half is surviving an attack that still gets through. It costs less than the first half, but it is almost always missing.
Where do you start if you have nothing? With an inventory of critical systems and one isolated copy of the main database. This is a week of work and a minimal budget, and it cuts potential downtime several times over.
Is your team ready for the first hour of a crisis?
You test a plan by running a scenario. Reading it is not enough. The assessment shows the gaps, and the corporate format works through them with your team on your own processes.