Ransomware encrypts your files and demands a ransom for the decryption key. Attackers no longer choose their targets by size but by vulnerability, which puts SMEs in the front line: they hold critical data and have few defences.
How they get in
The booby-trapped email
Still the leading vector. An attachment opened, a link clicked, and the payload installs itself. Today’s messages are well crafted, in correct language, and often tied to a plausible context such as an invoice or a delivery.
Exposed remote access
A remote desktop service open to the internet with a weak password is forced within hours. It is the quietest way in, because it requires no human error at all.
Unpatched flaws
The vast majority of intrusions exploit known vulnerabilities that were fixed long ago. The patch existed; it was not applied.
The measures that genuinely protect
Ranked by effectiveness against cost.
Offline backup
This is the only protection that works when everything else has failed. A disconnected or immutable copy is what allows you to refuse the ransom. See our article on backup and disaster recovery.
Two-factor authentication
On email and all remote access. A stolen password becomes unusable.
Closing direct remote access
Remote access should go through a secure tunnel, never be exposed directly on the internet.
Separate privileged accounts
Nobody works day to day with an administrator account. That single rule considerably limits how far an attack spreads.
Disciplined patching
A monthly schedule that is actually applied beats an expensive detection tool that is poorly configured.
The first hours: what to do
- Isolate without switching off. Disconnect the affected machines from the network. Do not power them down: memory holds evidence useful to the analysis.
- Cut shares and access to backups to stop the spread.
- Preserve the evidence. Logs, timestamps, the ransom note: all of it helps to understand the origin and supports any complaint you file.
- Do not pay. Payment guarantees neither the key nor the absence of a data leak, and it identifies you as a receptive target.
- Restore from a clean backup, after checking that the source of the intrusion is closed.
- Communicate. Your customers and partners will hear about the incident. Better that they hear it from you.
The mistake to avoid at all costs
Restoring before identifying and closing the way in. You then re-establish a clean environment inside an infrastructure that is still compromised, and the attack starts again a few days later, sometimes with a backup that is now unusable.
Frequently asked questions
Is antivirus enough?
No. It blocks known threats but not an intrusion through remote access with valid credentials. It is one layer among others, not complete protection.
Does insurance cover this risk?
Policies exist, but they generally make payment conditional on minimum security measures. Read the exclusions carefully.
Do we have to report the incident?
If personal data is involved, the question of informing the supervisory authority and the individuals arises. See our article on law 09-08.
How we work
Systomap runs exposure audits, closes risky access paths and puts offline backups in place. Let us take stock.
