Small businesses are not targeted because of what they hold. They are targeted because the attack is automated and they answered. That changes what preparation is worth doing.
Four things, in this order
One: a backup you have restored from. Not a backup job reporting success. An actual restore, performed on purpose, timed. If you have never done it you do not know how long it takes, and the number matters more than you expect: it is the length of time your business is stopped. Keep one copy the production network cannot reach.
Two: multi-factor authentication on email. Email is where the money moves, because it is where invoices and bank details are agreed. Almost every payment-diversion fraud we are asked to investigate after the fact would have been stopped here.
Three: patch the things exposed to the internet. The firewall, the VPN, the remote-access tool, the router the ISP supplied and nobody has logged into since. Internal machines matter less than the ones answering from outside.
Four: fewer administrators. Day-to-day work should not run as an administrator. This one costs nothing and is the most commonly refused.
What usually gets bought instead
A more expensive endpoint product. It is not useless, but it is the fifth item on a list of four, and it is frequently bought by organisations that have not done the first one. Ordering matters: no detection tool prevents the situation where the data is encrypted and the only copy was on the same network.
Decide the phone call in advance
The worst hour to work out who to call is the hour it happens. Write down, on paper, who declares an incident, who talks to staff, who talks to customers, and who is allowed to authorise taking systems offline. Under the amended PDPA you may also owe a regulatory notification on a short clock, which is difficult to do well while also deciding who is in charge.
- Who decides it is an incident, and their deputy.
- Who can disconnect systems without asking permission.
- Where the restore instructions are, offline.
- Which numbers to call, printed rather than stored in the system.