The best protection against ransomware is layered: MFA on remote access and admin accounts, fast patching, few internet-facing systems, 24/7 monitoring, offline backups that you have tested and staff who can spot phishing. Ireland's National Cyber Security Centre recommends exactly that list. ERS IT Solutions, in Blanchardstown, Dublin 15 since 1983, runs these controls for Irish businesses and responds when something gets through.
What is ransomware and how does it work?
Ransomware is malicious software that encrypts files on a device so they, and the systems that rely on them, cannot be used. According to the NCSC, attackers typically demand a ransom for a decryption key, or to stop stolen data being leaked or sold. Most attacks now do both: they copy your data first, then encrypt it, so backups alone do not remove the threat of a leak.
It is not only a big-company problem. In a joint warning, the NCSC and the Garda National Cyber Crime Bureau said they had seen "a trend of small and medium-sized businesses being increasingly targeted by ransomware groups" (gov.ie). Ireland also saw the scale of the damage in May 2021, when the HSE's central IT systems were crippled by a ransomware attack.
How does a ransomware attack happen?
The NCSC describes a ransomware attack in three stages: gaining access, preparation and impact.
- Gaining access. Attackers get in through a phishing email, stolen or guessed passwords, an unpatched internet-facing device such as a VPN or firewall, or remote desktop left open to the internet.
- Preparation. Once inside, they move around the network, steal admin credentials, find and delete backups, switch off security tools and copy data out. This can take days or weeks, which is the window in which monitoring can catch them.
- Impact. They encrypt as many systems as possible at once, usually out of hours, and leave a ransom note.
The NCSC's point is that every stage is a chance to stop them. Its Ransomware Quick Guide calls this breaking the chain.
Ransomware vs malware, phishing and spyware
| Term | What it is | How it relates to ransomware |
|---|---|---|
| Malware | Any malicious software | Ransomware is one type of malware |
| Phishing | A fake message designed to trick someone into clicking, opening or entering details | A common way ransomware gets in |
| Spyware | Malware that secretly watches activity or steals information | Steals quietly and stays hidden, where ransomware announces itself and demands money |
| Ransomware | Malware that encrypts or steals data for payment | The end goal of many intrusions |
So "ransomware vs phishing" is not either-or: phishing is often the door, ransomware is what comes through it.
Ransomware prevention checklist
How to prevent ransomware attacks in practice: this list follows the NCSC's priority actions, with what each means for a typical Irish SME.
- Shrink your attack surface. Keep internet-facing devices to a minimum and close unused ports and protocols. Never leave remote desktop open to the internet.
- Patch quickly. Run vulnerability scans and keep all hardware and software updated, especially edge devices like firewalls and VPNs. Remove unsupported systems.
- Turn on MFA. The NCSC says all remote access and privileged accounts should have MFA, and where possible use an authenticator app rather than SMS. Extend it to every Microsoft 365 account.
- Separate admin accounts. Do not use admin accounts for email or browsing.
- Monitor and log. The NCSC says effective logging and monitoring lets you detect attackers on your network and remove them. This is what managed detection and response does, 24/7.
- Back up with the 3-2-1 rule. Three copies, on two separate systems, with one offline, per the NCSC. Test that you can restore.
- Have a plan and test it. Write down who does what and who to call, and rehearse it.
- Train staff. The NCSC says a well-educated workforce is key to preventing and responding to incidents. Run regular awareness training and phishing simulations.
- Filter email. Block malicious attachments and links before they reach inboxes. See our email security guide.
- Watch for leaked passwords. Dark web monitoring alerts you when staff credentials appear for sale.
What is the best defence against ransomware?
There is no single best product. The strongest protection is a combination of MFA, which blocks most use of stolen passwords; 24/7 monitoring with people who respond, which catches attackers during the preparation stage; and offline, tested backups, which mean you can recover without paying. If you can only start with three things, start with those.
Endpoint detection and response (EDR) on its own helps, but someone must act on its alerts at 3am on a Saturday. That is the difference between EDR software and a managed service. Our MDR page explains it.
How to detect ransomware before it encrypts
Warning signs during the preparation stage include:
- Logins at unusual times or from unusual countries, or "impossible travel" between two locations.
- New admin accounts, or existing accounts added to admin groups.
- Security tools switched off or uninstalled.
- Backup jobs failing, or backups being deleted.
- Remote access tools you did not install.
- Large amounts of data leaving the network.
- Mass file renames or new file extensions appearing on a file share.
These are exactly the events MDR and Microsoft 365 monitoring alert on. Most small businesses cannot watch for them around the clock themselves.
What to do in the first hours of a ransomware attack
How to handle ransomware if you think it is running:
- Disconnect, do not power off. Unplug network cables and turn off Wi-Fi on affected devices. Leaving them on can preserve evidence for investigators.
- Call your IT provider or security team immediately. ERS clients call 01 885 9500.
- Stop it spreading. Disable compromised accounts, block remote access and isolate affected servers.
- Protect your backups. Disconnect backup systems so they cannot be encrypted too.
- Call your cyber insurer's hotline if you have cover, before you spend money on recovery.
- Preserve evidence. Photograph the ransom note. Do not delete logs, emails or files.
- Do not contact the attackers or pay without advice.
- Report it. See below.
- Check whether personal data is involved. If it is, you may need to notify the Data Protection Commission within 72 hours.
- Restore from clean backups only once the attacker's access has been removed, and reset passwords.
How do I report ransomware in Ireland?
Ransomware is a crime. Report it to An Garda Síochána. The NCSC and the Garda National Cyber Crime Bureau encourage businesses to report incidents to both of them, as reporting helps them investigate and warn others (gov.ie).
- An Garda Síochána: your local Garda station.
- NCSC: the NCSC's Ransomware Quick Guide says you may also report ransomware incidents to the NCSC. Its incident reporting page explains that its incident response team, CSIRT-IE, mainly supports government and critical national infrastructure, and takes reports of incidents that may have a national impact at [email protected].
- Data Protection Commission: if personal data has been accessed or encrypted and there is a risk to individuals, notify the DPC within 72 hours of becoming aware.
- NIS2 entities: once Ireland's law is in force, a significant incident needs an early warning within 24 hours. See our NIS2 guide.
Should we pay the ransom?
Irish authorities advise against it. The NCSC and GNCCB say they do not "encourage, endorse nor condone the payment of ransoms". The Head of the GNCCB has said there is no guarantee that paying will get your data decrypted or stop it being leaked, and that it may lead to your organisation being targeted again. Check No More Ransom, a law enforcement project that publishes free decryption tools for some ransomware families, before anything else.
How to recover from ransomware
Recovery is mostly about backups and time. Ask yourself now: how long would it take to restore your systems from scratch? When ERS rebuilt Forsa's infrastructure, with virtualisation and offsite disaster recovery replication, its recovery time objective went from 3 days to 4 hours. That is the kind of figure to know before an attack, not after. Our backup and disaster recovery service is built around tested restores.
How ERS protects against ransomware
- 24/7 managed detection and response with threat hunting and containment.
- Microsoft 365 monitoring for account takeover, the most common starting point.
- Patching, MFA and secure configuration as part of our managed cyber security services.
- Offline and tested backups, and a recovery plan.
- Staff training and phishing simulations.
ERS quotes per business after a short call. Contact us or call 01 885 9500.