Ransomware remains one of the most disruptive threats facing organisations across the Middle East, Africa and India. Attackers no longer just encrypt files. They steal data first, threaten to leak it, and target backups so that recovery is slow and painful. The good news is that most successful attacks still exploit a small number of well-known weaknesses. Closing them makes your organisation a much harder target.
Below are ten practical controls we recommend to every customer, whatever their size or sector.
1. Know what you have
You cannot protect assets you do not know about. Keep an up-to-date inventory of servers, endpoints, cloud workloads, SaaS applications and internet-facing services. Forgotten VPN gateways, test servers and exposed remote desktop services are common entry points.
2. Enforce multi-factor authentication everywhere it matters
Stolen or guessed passwords remain a leading cause of breaches. Require MFA for email, VPN, remote access, cloud consoles and all privileged accounts. Prefer phishing-resistant methods such as FIDO2 security keys or passkeys for administrators.
3. Patch internet-facing systems first
Ransomware groups move quickly once a vulnerability in a firewall, VPN or file-transfer product is published. Prioritise patching by exposure and exploitability, not just by severity score, and track critical fixes to closure within days rather than weeks.
4. Limit and protect privileged access
Attackers need administrator rights to spread and disable defences. Remove standing domain admin rights, use separate admin accounts, vault and rotate privileged credentials, and apply just-in-time access for sensitive systems.
5. Segment your network
A flat network lets one infected laptop reach every server. Separate user, server, management and OT networks, and restrict lateral protocols such as SMB and RDP between them. Good segmentation turns a company-wide outage into a contained incident.
6. Deploy EDR and actually watch it
Modern endpoint detection and response (EDR) tools can stop ransomware behaviour before encryption completes, but only if alerts are reviewed and acted on around the clock. Many organisations pair EDR with a managed detection and response service so someone is always watching.
7. Make backups ransomware-proof
Follow the 3-2-1 rule: three copies of your data, on two different media, with one copy offline or immutable. Keep backup systems on a separate identity domain, protect backup consoles with MFA, and test restores regularly. A backup you have never restored is only a hope.
8. Secure email and the web
Phishing emails and malicious downloads are still the most common delivery method. Use advanced email filtering, sandboxing for attachments and links, DNS filtering, and block macros and risky file types from the internet by default.
9. Train people and test them
Your employees are an important line of defence. Regular, short security awareness sessions and realistic phishing simulations build habits that technology alone cannot. Make it easy and blame-free to report suspicious messages.
10. Have a plan and rehearse it
Decide in advance who leads the response, how you will communicate if email is down, when to involve legal counsel and regulators, and how you will restore critical services. Run a tabletop exercise at least once a year with IT, management and communications teams.
Free download: score your organisation in 15 minutes with our Ransomware Readiness Checklist.
Where to start
If you only have time for three actions this quarter, focus on MFA for remote access and admins, patching internet-facing systems, and making at least one backup copy immutable. Then work through the rest of the list.
A1 Technology helps organisations assess their ransomware readiness and close the gaps, from network security assessments to anti-ransomware solutions and 24/7 monitoring. Book a free security assessment to find out how prepared you are.
