Prevention and Hardening

No single control stops ransomware. Prevention layers independent barriers so that bypassing one still leaves others standing. The goal is to make intrusion harder, spread slower, and recovery guaranteed.

This lesson covers the highest-impact controls: backups, segmentation, least privilege, MFA, patching, and attack-surface reduction.

Backups are the ultimate insurance against encryption. A robust strategy follows 3-2-1-1-0:

• 3 copies of data
• 2 different media types
• 1 copy offsite
• 1 copy offline or immutable
• 0 errors verified by regular restore tests

The immutable and offline copy is what survives an attacker with domain admin who hunts your backups.

Immutable backups cannot be modified or deleted for a set retention period, even by an administrator. Air-gapped copies are physically or logically disconnected so malware cannot reach them.

A flat network lets ransomware spread from one infected host to everything. Segmentation divides the network into zones with controlled traffic between them, containing the blast radius.

• Separate user, server, backup, and management networks
• Block workstation-to-workstation traffic, a common lateral path
• Isolate backup infrastructure behind its own controls

Even better, apply microsegmentation so each workload only talks to what it must.

Ransomware spreads with the privileges of whatever it compromises. Limiting those privileges limits the damage.

• Users should not be local admins on their machines
• Use separate, dedicated accounts for administrative tasks
• Avoid reusing the same local admin password across machines
• Grant access just in time and remove it when done

A compromised standard user account cannot encrypt the whole estate.

Stolen passwords drive a large share of intrusions. MFA blocks attackers who have a valid password but not the second factor.

• Enforce MFA on all remote access: VPN, RDP, webmail, admin portals
• Prefer phishing-resistant methods (FIDO2 hardware keys) over SMS
• Protect against MFA fatigue by requiring number matching

MFA on internet-facing access is one of the single most effective ransomware preventions.

Unpatched internet-facing systems are repeatedly exploited for initial access. Prioritize and shrink exposure.

• Patch internet-facing and actively exploited vulnerabilities first
• Remove or restrict exposed RDP and SMB from the internet
• Decommission unused services and legacy protocols
• Track known-exploited vulnerability lists for prioritization

Phishing is the top delivery method, so harden the inbox and the endpoint together.

• Email filtering, link rewriting, and attachment sandboxing
• SPF, DKIM, DMARC to reduce spoofing
• Block risky macro and script execution from email and the internet
• Deploy EDR to detect malicious behavior on endpoints

Combine technical controls with user awareness training on reporting suspicious messages.

Allowlisting what may execute stops most unknown payloads. Pair it with disabling abused features.

• Application allowlisting so only approved binaries run
• Disable Office macros from untrusted sources by default
• Restrict scripting hosts and built-in admin tools where feasible
• Enable OS exploit-mitigation and tamper protection on security tools

Tamper protection matters because operators try to disable EDR before encrypting.

Lateral movement runs on harvested credentials. Make them harder to steal and reuse.

• Protect against credential dumping from memory
• Use unique local admin passwords per host (managed rotation)
• Limit where privileged accounts can log in (no domain admin on workstations)
• Monitor for unusual authentication patterns

Constraining credential reuse breaks the chain between one compromised host and the whole domain.

Controls decay without upkeep. Treat prevention as an ongoing program:

• Regularly test restores, not just backup completion
• Run tabletop exercises so the team knows the plan
• Continuously inventory exposed services and privileged accounts
• Measure MFA coverage, patch latency, and segmentation gaps

A tested program turns a potential catastrophe into a manageable incident.

Choose the control that guarantees recovery.

You built layered defenses against ransomware.

• 3-2-1-1-0 backups with at least one immutable or air-gapped copy and tested restores
• Segmentation to contain spread; least privilege to limit damage
• MFA on all remote access; patch internet-facing and exploited bugs first
• Email, EDR, application allowlisting, and credential protection
• Run it as a program with restore tests and tabletop exercises

Next: detecting an attack already in progress.