Ransomware readiness for South African small businesses

Ransomware is malicious software that encrypts your files and systems, then demands payment for the key. Increasingly, attackers also copy data before encrypting it and threaten to publish it. For a small business, the impact is less about the ransom and more about the days of disruption, the cost of recovery and the conversation with clients.

The encouraging part is that most attacks on small and medium businesses are not sophisticated. They succeed because of a handful of common gaps, and those gaps can be closed with well-understood measures. This guide sets out how attacks usually get in, the layers that stop them, and how to be ready if one gets through anyway.

How attacks typically get in

There are four routes we see again and again.

• Phishing. An email that looks like an invoice, a courier notice or a shared document. The recipient clicks a link and enters their Microsoft 365 password on a fake page, or opens an attachment that installs something.
• Stolen passwords without MFA. Passwords leak from other websites and get reused. If an account has no multi-factor authentication, a stolen password is all an attacker needs.
• Exposed remote access. Remote Desktop opened directly to the internet, an old VPN with weak passwords, or a remote support tool left installed. Attackers scan for these constantly.
• Unpatched systems. Firewalls, servers and applications with known security flaws that have published fixes nobody has installed.

Once inside, attackers typically spend time looking around, raising their privileges, finding the backups and copying data before they trigger the encryption. That gap between entry and impact is an opportunity to catch them.

Layered defence

No single product stops ransomware. The aim is several layers, so that if one fails the next one holds.

Identity: MFA and Conditional Access

Multi-factor authentication on every Microsoft 365 account, with no exceptions for directors or shared mailboxes. Conditional Access policies in Entra ID can go further, for example blocking sign-ins from unexpected countries, requiring a compliant company device for sensitive data, or blocking older sign-in methods that cannot do MFA.

Endpoint detection and response (EDR)

Traditional antivirus looks for known bad files. EDR, such as SentinelOne, watches behaviour: a process that suddenly starts encrypting hundreds of files, or a tool trying to delete backup snapshots. It can isolate an affected device from the network and, where supported and correctly configured, roll back changes. It needs to be on every server and workstation, and someone needs to be watching its alerts.

Patching

Operating systems, browsers, Office, firewalls and line-of-business software, all updated on a regular schedule. Internet-facing devices such as the firewall deserve the closest attention.

Firewall and remote access

A properly configured firewall (we use FortiGate) with remote access through a secured VPN that requires MFA, never Remote Desktop exposed to the internet. Review who has VPN accounts and remove anyone who no longer needs one.

Email filtering

Filtering that catches most malicious links and attachments before they reach inboxes, combined with a habit of staff reporting suspicious messages rather than deleting them.

Least privilege

Staff work with standard accounts, not administrator accounts. Admin rights are given only to those who need them, on separate accounts used only for admin tasks. Shared folders are restricted to the people who need them, which limits how much damage one compromised account can do.

Backups isolated from the network

This is your last line of defence, so it has to survive the attack. At least one backup copy should be off-site and protected from deletion by ordinary network or admin accounts. Test restores regularly. Our backup self-check walks through the questions to ask.

Your incident plan on one page

When something goes wrong, people under pressure make hasty decisions. A one-page plan, printed and kept somewhere other than the network that might be encrypted, makes the first hour much calmer.

1. Who to call. Your IT provider’s emergency number, the director who makes decisions, and your cyber insurer’s claims line if you have a policy. Write the numbers down on paper.
2. Isolate. Disconnect affected devices from the network (unplug the cable, turn off Wi-Fi) but do not switch them off unless advised, as memory can hold useful evidence. If your EDR can isolate devices remotely, that is the fastest route.
3. Don’t pay hastily. Payment does not guarantee you get your data back or that it will not be published. It is a decision for the directors, with advice from your insurer and specialists, not something to rush on the first morning.
4. Preserve evidence. Do not wipe and rebuild immediately. Keep logs, the ransom note and any suspicious emails. These help establish what happened and what data was affected.
5. Communicate deliberately. Decide who speaks to staff, clients and suppliers, and use a channel you trust, such as phones, if email may be compromised.
6. Restore from known-good backups once the cause is understood and closed, so you are not restoring into a network the attacker still has access to.

A plan nobody has read is not much better than no plan. Walk through it once a year with the people named in it.

POPIA and notification

If personal information may have been accessed or acquired by an unauthorised person, section 22 of the Protection of Personal Information Act requires the responsible party to notify the Information Regulator and, in most cases, the affected people, as soon as reasonably possible after discovering the compromise. Ransomware that involves data being copied, or even possibly copied, is likely to fall into this category.

The notification must give enough information for affected people to take protective steps. There are limited circumstances in which notification to individuals may be delayed, for example at the request of law enforcement.

This is a general summary, not legal advice. Your information officer should be involved early, and you should take legal advice on your specific obligations. The practical point is that you need to know what data you hold and where it lives, so you can work out quickly what may have been affected. If you use AI tools with personal information, our post on POPIA and AI tools covers the related questions.

A 10-point readiness checklist

Use this as a quick self-assessment. Each “no” is a priority.

1. MFA is enforced on every Microsoft 365 account, including directors and admins.
2. Conditional Access policies block risky or legacy sign-ins.
3. EDR is installed on every server and workstation, and alerts are monitored around the clock.
4. Operating systems, applications and the firewall are patched on a regular schedule.
5. No Remote Desktop or similar service is exposed directly to the internet; remote access is via MFA-protected VPN.
6. Email filtering is in place and staff know how to report suspicious messages.
7. Staff use standard accounts; admin rights are limited and separate.
8. At least one backup copy is off-site and protected from deletion, and restores are tested regularly.
9. A one-page incident plan exists on paper, with names and phone numbers.
10. You know what personal information you hold and who your information officer is.

Getting ready, calmly

A 25-person engineering firm in Lynnwood does not need a security operations centre of its own. It needs these basics done properly and checked regularly. That is most of the work, and it is very achievable.

If you would like an outside view of where you stand, our free Automation & Risk Check covers security, backups and documentation, alongside where automation could help your team. It is a 30-minute conversation with a one-page report at the end. No obligation.