What exactly is ransomware — what's the first precaution a business our size should take?

Attackers usually brute-force exposed remote desktop ports or send macro-laced email attachments disguised as invoices. If you have legacy file sharing protocols enabled on your network, turn them off immediately, and audit your server's OS and accounting software security patches every single week.

Edit: asked below, I wrote the answer in the second message.

Here's the three-step starter setup we always suggest: 1) Take daily backups to an external drive and lock it in a drawer before heading home. 2) Enforce automatic OS updates across all staff machines. 3) Lock down field rep tablets with restricted profiles so they can only open the specific apps they actually need.

A client roughly your size got hit last year. Seven years of accounting records got encrypted, and the ransom demand was 450,000 TL at the exchange rate back then. They refused to pay, ended up having to manually re-enter four months of data from paper invoices one by one, and their entire operation was completely paralyzed for two months.

The first thing you should do is physically unplug the external drive from the server before heading home in the evening. A backup drive left plugged into the server will just get encrypted right along with it during an attack. This costs absolutely nothing and could single-handedly save you from a complete disaster tomorrow.

our accountant clicked an email disguised as a shipping tracking slip once locked up the whole pc. step one is making sure staff never open compressed files or executable files disguised as pdfs from unknown senders then even basic awareness training prevents so much.

note: I wrote this based on my own experience, it might not apply to everyone.

Does your outsourced IT support handle backups, and if so, when was the last time they actually tested a restore? Just having a backup file sitting there isn't enough; you need monthly tests to verify whether the file is corrupt or actually works.

To ensure internal data security, I advise including periodic backup verification and the deployment of security patches as binding clauses in your contract with your external IT service provider.

Our office got hit three years ago. We walked in one morning to red text and a countdown timer on the screen. Thank god our accounting manager used to copy the database to a separate thumb drive every Friday evening and lock it in the safe. We wiped the server clean and got away with losing only 3 days of data.

You're right. Most time waste accumulates in tasks waiting for approval.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

The discussion got scattered, let me summarize. Security isn't absolute; it's about making attacks not worth the effort.

When making a decision, first look at what data you have on hand. Hope this helps.

I've been dealing with this for a long time. The harder it is to reverse a decision the slower you should make it.

If you have questions write them; I'll answer as best I can.

The discussion got scattered, let me summarize. Processes without records never improve, because you don't know what to fix.

Just leaving this note, it might be useful.

i've been dealing with this for a long time. honestly if permission and scope aren't in writnig don't start that test.

just leaving this note, it might be useful.

If you're going this route, sort this out first. Taking measures without an inventory leaves doors you haven't seen open.

Proven by experience.

I'm writing this so you don't make the same mistake. The harder it is to reverse a decision, the slower you should make it.

This is my opinion, I'm not claiming it's absolute truth.

This approach has a cost, which isn't discussed. Payment information changes are never verified through the channel they came from.

Correct me if I'm wrong.

I agree with this. Don't rely on a single measure; go layer by layer.

Hope this helps.

Thanks for posting.