Cybersecurity
Ransomware: prevention measures and a response plan for small businesses
What ransomware actually does, the measures that block it or limit the damage, and the decisions to make in the first hours.
By the SolutionsCW team8 min read
What actually happens during an attack
Ransomware encrypts accessible files — workstations, servers, network drives, sometimes poorly protected backups — then demands payment for the decryption key. Modern groups often add a second pressure: threatening to publish data stolen before encryption. The attack typically enters through a phishing email, an poorly secured remote access or unpatched software.
The real cost exceeds the ransom: halted operations, system rebuilding, legal obligations if personal information is involved, and customer trust. In Quebec, such an event can constitute a privacy incident under Law 25, with notification duties where there is a risk of serious injury.
Measures that block or limit the damage
No single measure is enough; their combination makes the difference. Backups remain the last line: if everything else fails, a clean restore makes you independent of the blackmail.
- 3-2-1 backups with at least one offline or immutable copy, and tested restores: this is what turns a catastrophe into a bad week.
- MFA on all remote access and administrator accounts; no remote desktop exposed directly to the Internet.
- Patches applied quickly to systems, router, firewall and exposed applications.
- Endpoint protection (antivirus/EDR) kept up to date and monitored.
- Limited rights: employees have no administrator rights on their workstation, which slows propagation.
- Segmentation: the guest network and unmanaged devices have no access to company files.
The first hours: the response sequence
Disconnect affected devices from the network without powering them off, cut remote access, change administrator passwords from a clean device, and call your IT support and insurer before any decision. Preserve the attackers’ messages and technical traces: they serve the investigation and official procedures.
Whether to pay is a business and legal decision that should never be made alone: payment guarantees neither recovery nor non-publication of data, and it can carry legal implications. Canadian authorities advise against paying. Document everything, and assess the duty to notify the CAI and affected individuals with your advisors.
Prepare before it happens
A one-page plan — who to call, how to isolate, where backups are, who communicates — plus a yearly drill is enough for a small business to react fast. SolutionsCW implements verifiable backups, segmentation and protected access that make this scenario survivable, and documents the plan with you.
Sources and references
Products and rules can change. Check official sources before making a decision. SolutionsCW guides are informational and are not legal advice.