“You start your computer in the morning, only to find that all your company files have unreadable extensions and a pop-up demands a Bitcoin ransom.” This is ransomware. More small and medium-sized businesses have fallen victim over the past two years. An attack can halt operations for days or, in severe cases, wipe out critical data. This article explains how ransomware gets in, whether data can be recovered after an attack, and how small and medium-sized businesses can use backups and security measures to avoid losing everything.
The Hard Truth First
After a ransomware attack, data cannot be decrypted in the vast majority of cases (the encryption cannot be broken, and paying the ransom does not guarantee a decryption key). The priority is therefore not “How do we decrypt our files after an attack?” but “Do we already have a backup that ransomware cannot reach?” With one, recovery may take just a few hours. Without one, years of data could be lost.
How Ransomware Typically Enters a Business
- Phishing emails and attachments: Employees open attachments disguised as invoices, résumés, or delivery notices
- Weak passwords + Remote Desktop Protocol (RDP) exposed to the internet: Attackers gain direct access after cracking passwords through brute force (the most common route)
- Unpatched operating system or software vulnerabilities: Worm-like ransomware automatically scans for and exploits vulnerabilities
- Introduced through USB drives, pirated software, or contractors’ devices
The Key: Get Backups Right with the 3-2-1 Rule
Everyone knows backups are necessary, but many businesses have backups that offer no real protection: the backup drive stays connected to the computer, so ransomware encrypts the backup as well. The correct approach is the widely accepted 3-2-1 rule:
- 3 copies of your data: The original plus two backups
- 2 types of storage media: For example, local storage and cloud storage
- 1 offline or off-site copy: Keep at least one copy beyond ransomware’s reach (disconnected or stored in the cloud)—this copy is critical to recovery
For small and medium-sized businesses, this means keeping one scheduled local backup + one automatic incremental cloud backup of important data. The cloud copy remains beyond ransomware’s reach and can be retrieved directly if an incident occurs.
Essential Defenses Beyond Backups
| Defense | Action |
|---|---|
| Disable internet-facing RDP | Use zero trust access or a VPN for remote work; do not expose port 3389 directly to the internet |
| Strong passwords + MFA | Weak passwords are the leading entry point; enable multi-factor authentication for critical accounts |
| Apply patches promptly | Keep operating systems and frequently used software up to date |
| Endpoint protection | Install antivirus or EDR software and run regular full scans |
| Least-privilege access | Do not grant administrator privileges to standard users; assign shared-drive permissions based on need |
What to Do Immediately After an Attack
Stay calm. Do not immediately pay the ransom or rush to reinstall the system:
- Disconnect from the network immediately (unplug the network cable or disconnect WiFi) to prevent the infection from spreading to other computers and shared drives
- Isolate infected computers; do not shut them down or format their drives yet, as this may affect subsequent forensic investigation
- Restore from offline or cloud backups—this is when a backup beyond ransomware’s reach becomes essential
- Consider reporting the incident to the police or engaging a specialist team; paying the ransom is not recommended (it encourages crime and does not guarantee a decryption key)
A Simpler Approach for Small and Medium-Sized Businesses
Configuring backups and security on each computer, then regularly checking that data can be restored, takes considerable time and effort. A more practical option for small and medium-sized businesses is to entrust centralized management to an IT operations specialist. For example, Siwenlide can include automated scheduled backups + incremental cloud backups + endpoint protection + secure remote access in IT Operations Outsourcing, conduct regular recovery drills to verify that backups can actually be restored, and replace internet-facing remote desktops with more secure zero trust access. A local Beijing team provides on-site service, without requiring you to purchase a range of equipment and software yourself.
Frequently Asked Questions
Q: Can data be recovered after a ransomware attack?
A: Encrypted data generally cannot be decrypted, and paying the ransom does not guarantee a decryption key. The only reliable recovery method is to restore from an offline or cloud backup that ransomware has not affected. Preparing backups in advance is therefore far more important than attempting recovery after an attack.
Q: Why were my backups encrypted too?
A: Most likely, the backup drive remained online or connected, allowing ransomware to encrypt it as well. Follow the 3-2-1 rule and keep at least one offline or cloud backup beyond ransomware’s reach.
Q: How can a small business without dedicated IT staff implement this protection?
A: An IT Operations Services provider can handle centralized configuration and maintenance, including automated backups, incremental cloud backups, endpoint protection, and regular recovery drills. Your business simply needs to confirm that data can be restored if an incident occurs.
Q: What should we do first?
A: Two things: disable internet-facing remote desktops and switch to zero trust access or a VPN; then set up automatic cloud backups for important data. These two steps can prevent the vast majority of infections and losses.
Concerned About Ransomware Wiping Out Your Business Data?
Siwenlide can integrate automated backups + incremental cloud backups + endpoint protection + zero trust remote access into a fully managed IT operations service, with regular recovery drills to support rapid data restoration when an incident occurs. Local on-site service in Beijing, with no need to purchase equipment yourself. Call 400-686-2011 or visit siwenlide.com to learn more about our solutions.
