How to protect a small business from ransomware: a practical guide

Ransomware is the kind of attack in which criminals take your company's files hostage (by encrypting everything) and demand a ransom to return them. Today they almost always also steal the data first and threaten to publish it. Many people think this only happens to big companies, but small businesses are frequent targets precisely because they tend to have less protection. This guide shows what to do, in order of priority.

How ransomware gets in

In most cases, the entry point is one of these:

1. A scam email with an attachment or link (fake invoice, delivery notice, "shared document").
2. A leaked or weak password on remote access, VPN or email, without two-step verification.
3. Outdated equipment: a VPN, router, server or website with a known, unpatched flaw.
4. Pirated software or programs downloaded from dubious sites.
5. A compromised supplier that had access to your systems.

This year, cases such as the ransomware at IDC Frontier's cloud and attacks that entered through the GlobalProtect VPN showed that even large providers' infrastructure is not immune.

The 10 measures that protect the most

1. 3-2-1 backups with one offline or immutable copy. If criminals can delete your backup, you have no way out. Actually test restoring.
2. Two-step verification on email, VPN, remote access, banking and admin accounts.
3. Up-to-date software on Windows, browsers, routers, VPNs, websites and plugins. Prioritise anything exposed to the internet.
4. Active antivirus/EDR on every computer, with alerts going to a real person.
5. No admin rights for daily work. Staff use standard accounts; the admin account is kept separate.
6. Close what you don't use: remote desktop (RDP) open to the internet, router ports, old accounts.
7. Short, frequent training against scams, in each employee's language.
8. A phone-confirmation rule for payments and bank account changes.
9. A list of suppliers with access, and regular reviews of that access.
10. A written response plan: whom to call, what to disconnect, where the backups are.

You don't need to do everything at once. Items 1, 2 and 3 alone already cut the risk a lot.

What to do if your company is attacked

• Disconnect affected computers from the network (cable and Wi-Fi), but don't shut them down if you can avoid it: that helps the investigation.
• Don't pay right away and don't negotiate alone. Paying doesn't guarantee recovery and may fund new attacks.
• Notify your IT support and the police (in Japan, your local station or the prefectural police cybercrime contact) and, if personal data leaked, check whether you must report to the Personal Information Protection Commission (PPC).
• Preserve evidence: ransom notes, times, suspicious emails.
• Restore from a clean backup after making sure the entry point has been closed.

How much protection costs

Many measures are cheap: two-step verification, updates and training cost more time than money. The main expenses are usually cloud backup, antivirus/EDR and someone's time to set it up and monitor it.

At KGA IT, published prices are (tax included, starting prices):

• Security assessment: from ¥15,000.
• Data backup setup: from ¥8,000.
• System management: from ¥10,000/month.
• Business IT plan: ¥49,800/month, with security services and 24-hour emergency support.

The final price depends on the number of computers and servers. See the pricing page.

How KGA IT can help

We start with a security assessment: we check backups, accounts, updates, equipment exposed to the internet and how the team reacts to scams. You get a clear list of priorities. Then we can set up automatic backups, antivirus, firewalls and two-step verification, and train your team in Japanese, Portuguese, English, Filipino, Vietnamese, Spanish and other languages.

Talk to KGA IT

Don't wait for an attack to find out whether your backup works. The consultation is free and with no obligation. Contact KGA IT through the contact page, LINE or WhatsApp.