Defend Against Ransomware

Updated on August 21, 2026, by Xcitium

How Can You Defend Against Ransomware?

To defend against ransomware, organizations should use multiple layers of security rather than rely on antivirus alone. Keep systems patched, require phishing-resistant multi-factor authentication, deploy endpoint detection and response (EDR), restrict administrative privileges, segment networks, secure remote access, filter phishing attempts, maintain isolated backups, and continuously monitor for suspicious activity.

CISA specifically recommends offline encrypted backups, regular vulnerability scanning, MFA, least privilege, centrally managed anti-malware, application allowlisting and/or EDR, and controls for internet-facing services.

Ransomware is one of the most deadly cybersecurity threats to businesses and corporations of all sizes. To effectively combat ransomware, there is a need for a combination of advanced global threat intelligence, technical solutions appropriately configured according to best practices, and strong end-user education and training. Also, a secure backup solution (ideally a cloud-based backup) is a must to defend against ransomware.

Below are a few of the ways you’ll be able to defend your network against ransomware attacks and avoid paying ransom to cybercriminals.

#Educate Your Employees

Employees who lack awareness (and training) about ransomware and safe computing habits pose the greatest risks and are tempting targets for ransomware attacks. Thus, it is critical for any organization to educate its users and create awareness about ransomware.

#Secure Your Network

To defend against ransomware and other forms of malware, securing your network is a must. Apart from the use of endpoint security solutions, you should also use intrusion prevention and other security technologies at the network perimeter.

#Back Up Your Files Regularly

Depending on how quickly the ransomware is detected, how widely it has spread, and the level of data loss, recovery from a backup could be a good option.

However, this calls for a smarter backup strategy such as offline and cloud backups. By having a backup of your important files, you can safeguard your precious data from ransomware scams. Even if targeted, you don’t have to worry about the threats posed by the cybercriminals.

#Patch Your Systems And Applications

Many ransomware attacks are based on known vulnerabilities in software applications, as well as in operating system and plug-ins. Therefore it is critical for you to patch your systems and applications as and when the patches are available.

10 Ways to Defend Against Ransomware

For a list-snippet opportunity, place this immediately after the definition.

1. Keep operating systems and applications patched.
2. Require phishing-resistant MFA.
3. Deploy endpoint protection and EDR.
4. Protect email and train employees against phishing.
5. Apply least privilege to users and administrators.
6. Segment networks to restrict lateral movement.
7. Secure VPNs, RDP, and other remote-access services.
8. Maintain offline or immutable backups.
9. Continuously monitor endpoints, identities, and networks.
10. Create and regularly test a ransomware incident-response plan.

These controls address ransomware at several stages—from preventing initial access to limiting lateral movement and restoring systems after an incident.

Ransomware Defense at a Glance

Defend Against Ransomware: Segment Your Network To Prevent The Spread Of Ransomware

Once a system gets compromised, the ransomware will try to spread from that computer to other computers on that network. If it infiltrates a server where all the data and mission-critical applications reside, it can severely impact the business.

Segment your corporate network and keep critical applications and devices isolated on a separate network or virtual LAN to limit the spread of infection.

#Real-time Network Traffic Monitoring

There’s a lot of focus on filtering inbound connections, but there should also be filtering in outbound connections as well. Since the ransomware relies on the instruction given by a remote hacker, blocking the initial outbound attempts to connect to the attacker’s server can stop the ransomware at the initial stages.

#Secure Your Email System

Since ransomware spreads through emails as well, it is crucial for any organization to deploy good email security system. Spoofing is a type of fraudulent email activity in which cybercriminals send email messages from a forged sender address.

For a regular user, such emails appear to come from one legitimate user, but they are coming from someone completely different. This type of email may contain malicious attachments containing ransomware.

If you are an enterprise user, it is advisable to use Xcitium Advanced Endpoint Protection (AEP). Xcitium (AEP) provides complete end-to-end protection across the boundary, internal network, and across endpoints preventing even the most advanced malware, including the ransomware.

For more details about Xcitium Advanced Endpoint Protection, contact us at EnterpriseSolutions@comodo.com or +1 888-256-2608.

Why Antivirus Alone Cannot Fully Defend Against Ransomware

Traditional antivirus remains useful, but ransomware defense requires more than identifying known malicious files.

Modern attacks may begin through:

• Stolen credentials
• Phishing
• Vulnerable internet-facing systems
• Remote-access services
• Precursor malware
• Third-party access
• Misconfigured cloud resources
• Social engineering

Attackers may operate inside a network before deploying ransomware.

During this period, they can attempt to:

• Escalate privileges.
• Steal credentials.
• Move laterally.
• Disable security products.
• Exfiltrate information.
• Delete backups.
• Modify recovery settings.

CISA notes that ransomware deployment can occur late in a broader network compromise and may even be used to obscure earlier post-compromise activity.

Use MFA to Defend Against Ransomware

Compromised credentials are an important ransomware entry point.

An attacker who steals a username and password may attempt to access:

• Email
• VPN
• Cloud platforms
• Remote desktops
• Administrative systems
• Business applications

Multi-factor authentication adds another verification requirement.

CISA recommends phishing-resistant MFA, particularly for email, VPNs, and accounts accessing critical systems.

Prioritize MFA For:

• Administrator accounts
• VPN access
• Email
• Remote access
• Cloud administrators
• Backup administrators
• Privileged business applications

MFA should work alongside strong identity policies rather than replace them.

Patch Vulnerabilities Before Ransomware Attackers Exploit Them

Ransomware groups frequently target vulnerabilities and misconfigurations in internet-facing systems.

Businesses should establish a vulnerability-management process that includes:

1. Discover assets.
2. Scan for vulnerabilities.
3. Identify internet-facing weaknesses.
4. Prioritize vulnerabilities according to risk.
5. Patch or mitigate them.
6. Verify remediation.
7. Continuously repeat the process.

CISA specifically recommends regular vulnerability scanning and prioritizing weaknesses on internet-facing devices.

Simply having a patch-management policy is not enough.

Organizations should verify that critical updates have actually been deployed.

Use EDR to Detect Ransomware Behavior

Endpoint Detection and Response (EDR) provides deeper endpoint visibility than traditional malware scanning alone.

EDR may help security teams detect suspicious behaviors such as:

• Unexpected process execution
• Credential-access activity
• Security-tool tampering
• Suspicious scripts
• Persistence mechanisms
• Lateral movement
• Unusual file modifications
• Ransomware execution

CISA recommends EDR and/or application allowlisting on assets to reduce unauthorized software execution and improve ransomware defense.

Antivirus vs. EDR for Ransomware

Organizations often use both capabilities together.

Protect Email Against Ransomware

Phishing and social engineering remain important initial-access methods.

Attackers may send:

• Malicious attachments
• Fake login pages
• Credential-stealing links
• Impersonation messages
• Malicious archives
• Social-engineering messages

Email defenses should therefore include:

• Anti-phishing controls
• Attachment scanning
• URL analysis
• Impersonation detection
• Domain authentication
• User reporting mechanisms
• Security awareness training

Employees should know how to report suspicious messages rather than simply delete them.

Reported phishing attempts can provide valuable early-warning information to security teams.

Secure RDP, VPNs, and Remote Access

Remote-access infrastructure is particularly sensitive because it can provide a path directly into organizational networks.

CISA recommends avoiding exposure of services such as Remote Desktop Protocol (RDP) directly to the internet and using compensating security controls where remote services are necessary.

Organizations should:

• Avoid unnecessary internet exposure.
• Require MFA.
• Restrict access by policy.
• Monitor failed logins.
• Disable unused accounts.
• Patch VPN appliances.
• Review remote-access logs.
• Limit administrative access.
• Remove unnecessary services.

Repeated failed authentication attempts should trigger investigation.

Apply Least Privilege

Users should receive only the permissions necessary to perform their jobs.

This principle is known as least privilege.

If ransomware compromises an account with excessive privileges, the attacker may gain greater ability to:

• Access servers.
• Disable security tools.
• Delete backups.
• Steal information.
• Change configurations.
• Spread across systems.

Separate ordinary user accounts from administrator accounts.

CISA specifically recommends separating administrative and standard accounts and applying least privilege across systems and services.

Segment Networks to Limit Ransomware Spread

A flat network can make lateral movement easier after one endpoint is compromised.

Network segmentation separates systems according to factors such as:

• Business function
• Sensitivity
• Trust level
• Application requirements
• User role

For example, ordinary employee workstations should not automatically have unrestricted access to:

• Backup infrastructure
• Domain controllers
• Critical servers
• Administrative networks

Segmentation does not necessarily stop initial infection.

Its purpose is to help contain the blast radius.

Use Application Allowlisting

Application allowlisting permits approved applications to run while restricting unauthorized software.

This approach can help reduce ransomware execution opportunities.

CISA recommends allowlisting rather than attempting to create exhaustive lists of every potentially malicious application.

Allowlisting can be particularly useful for:

• Critical servers
• Administrative workstations
• High-value systems
• Specialized business endpoints

However, policies need careful testing to avoid disrupting legitimate applications.

Why You Must Test Ransomware Backups

Having backups does not prove that recovery will work.

Organizations should regularly test:

• Whether backups can be accessed.
• Whether critical systems can be restored.
• Whether backups contain clean data.
• How long recovery takes.
• Which systems must be restored first.
• Whether backup credentials remain protected.

Microsoft recommends establishing recovery-time objectives and testing the ability to restore business-critical information.

A ransomware recovery exercise can reveal weaknesses before a real incident occurs.

Protect Backups From Ransomware

Ransomware operators understand that backups reduce their leverage.

As a result, attackers may try to:

• Delete backup files.
• Disable backup software.
• Remove snapshots.
• Compromise backup administrator accounts.
• Change retention policies.
• Encrypt accessible backup repositories.

Protect backup systems using:

• Separate administrative credentials
• MFA
• Least privilege
• Network isolation
• Immutable storage
• Offline copies
• Monitoring
• Deletion protection

Backups should not be managed with the same compromised credentials used across ordinary production systems.

Zero Trust and Ransomware Defense

Zero Trust assumes that access should not be automatically trusted simply because a user or device is inside the corporate network.

Useful Zero Trust principles include:

• Verify explicitly.
• Apply least privilege.
• Authenticate strongly.
• Evaluate device security.
• Segment critical resources.
• Monitor sessions.
• Continuously evaluate risk.

CISA includes Zero Trust access controls among its ransomware recommendations, particularly for restricting user-to-resource and resource-to-resource access.

Protect Against Third-Party Ransomware Risk

Suppliers, contractors, and managed service providers can also create pathways into an organization.

Organizations should:

• Assess vendor security.
• Limit third-party privileges.
• Require MFA.
• Separate vendor access.
• Monitor external accounts.
• Remove access when contracts end.
• Define security requirements contractually.
• Review how third parties protect backups.

CISA specifically warns organizations to consider the cyber hygiene of third parties and MSPs because managed providers have previously served as ransomware infection vectors affecting multiple clients.

Frequently Asked Questions About Defending Against Ransomware

What is the best defense against ransomware?

There is no single ransomware defense. The strongest approach combines MFA, patching, endpoint protection and EDR, least privilege, network segmentation, secure remote access, email security, offline or immutable backups, continuous monitoring, and tested incident-response procedures.

Can antivirus stop ransomware?

Antivirus can detect and block many ransomware threats, but it should not be the only defense. Organizations should combine it with EDR, MFA, vulnerability management, application controls, network security, monitoring, and resilient backups.

Do backups protect against ransomware?

Backups provide a critical recovery option, but they must themselves be protected. CISA recommends offline encrypted backups and regular recovery testing because ransomware can target accessible backups.

Does MFA prevent ransomware?

MFA can significantly reduce risks associated with stolen credentials, particularly for email, VPN, remote access, and privileged accounts. It does not stop every ransomware technique, so it should be one layer of a broader defense strategy.

Does network segmentation prevent ransomware?

Network segmentation may not prevent the first compromised device, but it can make lateral movement more difficult and reduce how many systems an attacker can reach.

Can ransomware infect cloud backups?

Cloud backups can be at risk if attackers gain sufficient permissions or if backups remain accessible through compromised accounts. Protect them using MFA, separate privileges, deletion protection, immutability where appropriate, logging, and versioning.

What should I do first if ransomware is detected?

Isolate affected systems immediately to help limit further spread, then activate the organization’s incident-response process and investigate the scope of compromise. CISA places system identification and isolation at the beginning of its ransomware response checklist.

Discover Malware For Free

Xcitium Antivirus Resources

Ransomware File Recovery

Related Sources:

Deal With Ransomware On Linux