What should we do against ransomware — which layers are essential for a small business?

The vast majority of attacks come from internet-exposed remote desktop ports or macro-enabled files downloaded by staff. Never expose the default remote connection port on your server to the internet. If external access is required, allow it only through a VPN tunnel with two-factor authentication. Disabling the SMB1 protocol across the network and moving the accounting server to a separate subnet (VLAN) will prevent lateral movement.

At our 22-person wholesale distribution office, we felt just as exposed two years ago. We spent a total of 12,000 TL to buy two encrypted external hard drives. One stays locked in an offsite fireproof safe, and we rotate them to take backups every Friday at the end of the day. We also pay 3,000 TL a month for immutable cloud storage. Thanks to this simple setup, we've had complete peace of mind for the past two years.

Everyone talks about backups, but nobody tests whether that backup actually works. Hundreds of businesses who suffered like your neighbor were complacent thinking 'it backs up automatically anyway,' only to realize on disaster day that the database had been copying corrupted data for six months. If you don't do a full restore drill to a clean machine at least twice a year, you don't actually have a backup.

Your very first instruction to your outsourced IT guy today should be this: demote all admin accounts on staff computers to standard users immediately. Once employees can no longer install random software, browser extensions, or pirated files off the internet, the chances of ransomware creeping in drop by half.

our purchasing manager opened a zip file disguised as a tracking slip, and tens of thousands of pdf invoices in the shared folder were locked up in five minutes. you can set up the most expensive firewall out there, but if an employee clicks a fake email it's game over. like definitely get your staff some quick training on phishing emails.

Does your contract with the outsourced IT firm specify a service level agreement (SLA) for emergency response times? Also, when were the OS and database software security patches on your local server last updated? Vulnerabilities usually stem from these unpatched, outdated systems.

Immediate action plan for your company: 1) Set up an offline backup routine physically disconnected from the network, 2) Revoke local admin privileges for all users, 3) Shut down all internet-facing remote desktop connections and enforce a VPN, 4) Block all executable attachments on your mail server.

what happened to your neighbor is really unfortunate but it served as an early wake-up call for you then dont panic at all; a 15,000 TL budget is plenty to nail down the essentials. the key is training staff not to open emails claiming 'legal enforcement proceedings have been filed against you.'

To place your information security processes within an institutional framework, request an emergency action plan and data recovery procedures in writing from your external support provider. As a data controller, safeguarding third-party commercial data is a statutory obligation.

It's rare to find an explanation this clear.

The answer above hits the nail on the head. Payment information changes are never verified through the channel they came from.

This is my opinion, I'm not claiming it's absolute truth.

Good call starting this thread. Taking measures without an inventory leaves doors you haven't seen open.

Start with a small trial; don't commit to everything at once.

There's a common mistake people make when doing this. If you don't write this down from the start, it leads to arguments later.

Start with a small trial; don't commit to everything at once. If you have questions, write them; I'll answer as best I can.

We need to take it step by step. An untested backup is not a backup.

Good luck with that.

there is sometihng to watch out for. taking measures without an inventory leaves doors you haven't seen open.

when making decisions write down the worst-case scenrio too, not just the best then correct me if I'm wrong.

Correct.

I have a question, don't want to go off-topic though. Trying to do this alone is the most expensive way.

Hope this helps.