Which layers are truly essential against ransomware — priorities for a small business?

Ditch the weekly manual external hard drive routine tonight. In most breach incidents we investigate, that external drive was accidentally left plugged into the server, and the attackers encrypted it along with everything else. Backup storage must be completely severed—logically or physically—from the host OS. When attackers break in, the very first thing they hunt for is attached backup drives.

There are three things you can do on Monday morning without spending a single penny: 1) Leave no open ports exposed to the outside world on the server; close the remote desktop port on the router. 2) Revoke admin rights from users. 3) Enforce 2FA on all email accounts. The vast majority of ransomware breaches happen by exploiting these three vulnerabilities.

We went through a similar process last year in our 18-person office. We spent a total of 52.000 TL: we bought a standalone two-bay NAS, cold cloud backup storage, and centralized antivirus licenses for 20 users. We restricted access to the accounting server strictly to the 3 relevant computers. Two months ago an employee ran a malicious invoice file, but because they didn't have local admin privileges, the encryption was confined to just a few temporary files on their desktop, and nothing happened to the main database.

We sync our accounting folder to a shared cloud drive... If a computer gets infected and encrypts those files does the cloud treat it as a new version and save the encrypted copy or does that actually count as a backup?

To answer the newer member's question: yes, sync tools will treat the encrypted file as a new modification and upload it to the cloud right away. Now, you can technically recover earlier states from the cloud provider's version history, but doing that for thousands of files takes days, and sometimes the versions get corrupted anyway. Backing up and syncing are not the same thing; to protect against ransomware, you need one-way, version-locked backups that only the backup software itself can write to.

Be skeptical of consultants trying to sink 80.000 lira of your money into appliances and expensive boxes right off the bat. You can buy the most advanced hardware on the market, but the moment an employee approves a phishing email from an elevated account, most of that gear gets bypassed anyway. In small teams the real security investment isn't pricey hardware—it's strict access controls and offline backups.

what happened to your neighbor is definitely a huge wake-up call and honestly you got off easy. people tend to keep relying on external hard drives until it happens to them. your budget is actually more than enouugh for 22 people, so don't let it intimidate you but instead of getting bogged down in hardware secure the data first, and the rest can be handled step by step.

The consensus here is clear: 1) Stopping manual backups to external hard drives and setting up independent, immutable backups is the top priority. 2) Closing exposed RDP ports and enabling 2FA is the zero-cost first line of defense. 3) Stripping local admin rights prevents infections from spreading laterally. Any remaining budget should go toward basic network segmentation and centralized endpoint protection licenses.

I've been down this road, let me tell you. Most time waste accumulates in tasks waiting for approval.

When we decide without measuring, we always end up in the same place. That's all, sorry if I went on too long.

You're right I've been down that road too. If you don't write this down from the start it leads to arguments later.

Of course it varies if your situation is different.

I'd appreciate it if you shared the outcome.

Let me write how it's done in practice. An untested backup is not a backup.

Forgotten test environments are more often the entry point than live systems. That's all, sorry if I went on too long.

timelly topic.

Could you elaborate on that? Most incidents start with a leaked password, not a vulnerability.

Don't hesitate to ask; those who don't ask always pay more. That's all, sorry if I went on too long.

Looking at it as a process, the picture changes. Mistakes made on the ransomware prevention side are usually reversible but expensive.

If I were you, I'd go this route.

Thanks for writing this, that's the right way. When you try to change everything at once, nothing settles.

Just leaving this note, it might be useful.

You're right. Solutions that work at a small scale collapse when you grow; I learned this late.

Proven by experience.

Quick summary for newcomers: Hasty decisions become decisions you have to fix six months later.

If 2FA is on, a stolen password alone is useless. If you have questions write them; I'll answer as best I can.