Guide
How to protect a small business from ransomware
Ransomware locks your files and demands payment. You can't make it impossible, but a handful of habits make it far less likely, and make sure you can recover without paying if it happens.
1. Backups that ransomware can't reach
This is the one that decides whether a bad day becomes a disaster.
- Follow the 3-2-1 rule: three copies of important data, on two kinds of storage, with one copy off-site.
- Keep at least one copy offline or immutable: a disconnected drive, or a backup service that won't let anyone delete or overwrite recent versions, using separate login details.
- Test restores every few months. A backup you have never restored is a hope, not a plan.
2. Patch quickly
Install Windows and application updates within days, not months, especially on anything reachable from the internet (remote desktop, VPNs, firewalls). Our patch management guide gives a simple monthly routine.
3. Multi-factor authentication everywhere
Turn on MFA for email, Microsoft 365 or Google Workspace, remote access, banking and your backup service. Stolen passwords are one of the most common ways in.
4. Nobody works as an administrator
Staff should use standard accounts day to day. Keep separate admin accounts for IT tasks, protected with MFA. This limits what malware can do if someone clicks the wrong thing.
5. Don't expose remote desktop
Never leave Remote Desktop (RDP) open directly to the internet. Use a VPN with MFA or a remote support tool that connects outward and logs every session.
6. Make sure protection is actually on
Every computer should have real-time protection on and up to date, the firewall on, and ransomware protection (Controlled folder access) considered for shared and important folders. The hard part in a business is knowing that this is true on every machine. An RMM such as CitadelGate is built to show you that in one place.
7. Train for email
Show staff what phishing looks like (our phishing guide helps) and make it easy and blame-free to report a mistake quickly.
On the day: what to do
- Disconnect affected computers from the network (cable and Wi-Fi). Don't switch them off yet if your IT provider may need evidence.
- Disconnect backup drives and pause sync services.
- Call your IT provider, and your insurer if you have cyber cover.
- Change passwords and revoke sessions from a clean device.
- Assess whether personal information was affected and take advice on POPIA notification.
- Restore from clean backups only after the way in has been found and closed.
Frequently asked questions
Should we pay a ransom?
Paying does not guarantee you get your data back and funds criminals. The best position is never needing to: tested backups that the attackers could not reach. Get professional and legal advice before any decision.
Is cloud storage like OneDrive a backup?
Not on its own. Synced folders can sync the encrypted files too. Version history helps, but you still need a separate backup with its own credentials and retention.
Do we have to report a ransomware attack?
If personal information may have been accessed, POPIA requires you to notify the Information Regulator and, in most cases, the affected people, as soon as reasonably possible. Take legal advice.
Help shape CitadelGate before launch
We are looking for a small number of South African MSPs and IT teams to pilot AI-assisted ticket remediation on test devices first. No cost, no commitment.