Ransomware Readiness: Controls That Actually Stop It
Ransomware conversations drift toward backups because backups are the comfortable part. Nobody has to admit anything awkward to discuss retention policies. The uncomfortable truth is that by the time backups matter, the attacker has usually been inside for days, and every control that could have made the whole thing a Tuesday annoyance instead of a board meeting has already failed quietly.
Recovery is the last line. Readiness is everything you place in front of it.
The path is boring, which is good news
Strip the branding off any major ransomware incident and the sequence is almost always the same. A way in: phished credentials, an exposed remote access service, an unpatched edge device. A way up: local admin sprawl, dumped credentials, an over-trusted service account. A way across: flat networks, open file shares, reachable backup infrastructure. Then the quiet phase, disabling security tools and staging, and only at the very end the part everyone pictures, the encryption.
Boring is good news because predictable is defensible. Each stage is a place to break the chain, and breaking it early is worth ten times breaking it late.
Identity carries the incident
Stolen credentials start the majority of these incidents and enable every later stage, so identity is where readiness money works hardest. MFA everywhere means everywhere: the VPN, the legacy webmail, the vendor portal with an SSO exception from 2023. Attackers do not attack your strongest login page. They find the one system that got an exception.
The second identity control that changes outcomes is admin tiering. Domain admins that never touch workstations, separate accounts for administration and email, and no service accounts in the domain admins group. Ransomware crews turn one workstation into the whole domain precisely through the shortcuts tiering removes.
The edge is on a timer
Internet-facing systems with known exploited vulnerabilities are not a risk, they are a countdown. When something on CISA's known-exploited list matches your edge, the patch window is hours to days, no matter what your normal cycle says. That requires knowing your edge, which is its own project: most organizations that scan their public ranges for the first time find at least one thing they had forgotten was there.
Make the network hostile to lateral movement
Perfect microsegmentation is a multi-year program; useful segmentation is a quarter. Three questions get you most of the value. Can workstations talk to each other? They almost never need to. Can workstations reach the backup infrastructure? They absolutely must not. Can anything reach the identity systems that does not strictly need to? Each "yes" you turn into a "no" removes a highway the attacker was counting on.
Endpoint coverage belongs here too, with one metric that matters more than the vendor logo: the percentage of machines actually reporting. Attackers hunt for the unprotected server everyone forgot, and an EDR agent that is installed but silenced is a false sense of security with a dashboard.
Backups that survive contact
Modern crews delete backups before encrypting, so the backup system must be built for an attacker with admin rights. Immutable or genuinely offline copies. Backup consoles with separate credentials and their own MFA, defended like a domain controller, because in an incident that is what it is. And restores that have been rehearsed with a stopwatch, because "we have backups" and "we can be running by Monday" are very different sentences, and the difference is usually the ransom decision.
Speed is a control
Every stage before encryption is noisy if anyone is listening: security tools being disabled, odd admin activity at odd hours, credentials probing shares, canary files being touched. Organizations that catch ransomware mid-chain are rarely the ones with the most expensive stack. They are the ones where a specific person sees the alert and has standing authority to isolate machines first and explain later.
If you only do one thing this week
Check whether the credentials that manage your backups would fall with your domain. If a domain admin can reach the backup console, fix that before anything else on this page. It is the difference between an incident and a catastrophe.
If this is on your plate, TecLeads does exactly this as part of our Cybersecurity work. If you'd like a second pair of eyes on your setup, book a 30-minute call or explore what we do.