Table of Contents
Ransomware gangs have changed their maths. Large companies have bigger budgets, stronger security teams and negotiators on retainer. Small businesses, by contrast, often hold valuable data, depend on a handful of systems, and have no dedicated security staff at all. That combination makes small and medium-sized businesses an increasingly attractive target — and it means owners need a practical defence playbook, not fear.
Attackers are not usually breaking in with exotic tools. They enter through phished passwords, exposed remote access, unpatched software or a supplier account, then move quietly before encrypting files and stealing copies for double extortion. Official guidance reflects that pattern: CISA’s cyber guidance for small businesses stresses multi-factor authentication, patching and tested backups as core defences.
Why small businesses are targeted
First, downtime hurts immediately. A clinic, law firm, retailer or manufacturer that loses its booking, billing or production system feels pressure within hours, which gangs count on when demanding payment. Second, defences are uneven: shared passwords, a single administrator account and ageing routers are common. Third, small firms are connected to larger ones, so a compromise can become a supply-chain route into bigger victims. Finally, many owners assume they are too small to notice — an assumption attackers exploit precisely because it lowers vigilance.
The defence playbook
1. Back up properly — and test the restore
Keep at least three copies of important data, on two different types of storage, with one copy offline or immutable so ransomware cannot encrypt it too. Automate backups, protect them with separate credentials, and test a full restore on a schedule. An untested backup is a hope, not a plan. Knowing how long restoration actually takes also tells you how much downtime to plan for.
2. Turn on multi-factor authentication everywhere
Require MFA for email, remote desktop, VPNs, cloud storage, banking and administrator accounts first, then for everything else. Use an authenticator app or security key rather than text messages where possible, and check regularly for accounts — especially new starters and administrators — that have not enrolled. Stolen passwords alone should never be enough to get in.
3. Patch fast, and remove what is unsupported
Enable automatic updates for operating systems, browsers, office software and routers. Prioritise known exploited vulnerabilities, replace software and hardware that no longer receive security fixes, and turn off remote access you do not actually need. Many incidents begin with a flaw for which a fix had been available for months.
4. Train people, and make reporting easy
Most attacks still start with a convincing email, message or phone call. Short, regular training beats an annual lecture: teach staff to check sender addresses, be suspicious of urgent payment changes, and verify bank-detail requests by a separate channel. Praise quick reporting — the employee who flags a suspicious message in five minutes can save the whole company. Related coverage: How Attacking Full-Backs Engineered Shot Creation and Corner Accumulation in 2008/09 La Liga.
5. Limit access and segment the network
Give each person only the access their job needs, use unique passwords held in a password manager, and keep separate administrator accounts for IT tasks. Segment guest Wi-Fi and everyday laptops away from finance and file servers, so one compromised device cannot reach everything.
Prepare for the bad day
Write a one-page incident plan with names and phone numbers: who isolates machines, who calls the insurer, bank, IT provider and — if personal data is involved — the relevant regulator and affected customers. Decide in advance that paying a ransom is not a strategy; it does not guarantee data returns and may invite repeat attacks. Practise the plan once, even as a tabletop discussion.
None of this requires an enterprise budget. Backups, MFA, patching, training and least-privilege access cover the routes most gangs actually use. Done consistently, they turn a small business from a soft target into a hard, unprofitable one — which is exactly where owners want to be.
