Ransomware remains the most disruptive cyber threat facing organisations in the region. The good news is that most attacks follow a predictable path: initial access, privilege escalation, lateral movement, backup destruction and finally encryption. Break that chain at any point and the attack fails.
1. Enforce multi-factor authentication everywhere
Email, VPN, remote desktop, cloud consoles and all administrator accounts. Stolen passwords remain the most common entry point; MFA neutralises most of them. Prefer phishing-resistant methods (FIDO2 keys or number-matching) for privileged users.
2. Remove exposed remote access
Internet-facing RDP and unpatched VPN appliances are a favourite of ransomware affiliates. Put remote access behind MFA and a modern access gateway, and patch edge devices within days of critical advisories.
3. Make backups immutable and offline
Attackers specifically hunt for backups. Keep at least one copy immutable or offline, protect backup consoles with separate credentials and MFA, and test restores — a backup you have never restored is a hope, not a plan.
4. Segment the network
Flat networks let one compromised laptop reach every server. Separate users, servers, management interfaces, guests and OT. Restrict administrative protocols between segments.
5. Deploy EDR with 24/7 monitoring
Modern endpoint detection and response can stop encryption behaviour — but only if someone is watching the alerts at 3 a.m. on a Saturday, when most attacks are launched.
6. Limit and protect privileged accounts
Reduce domain admins to the minimum, use separate admin accounts, and implement privileged access management for critical systems.
7. Patch what is actively exploited first
Prioritise vulnerabilities listed in known-exploited catalogues over raw CVSS scores.
8. Harden email
Enforce SPF, DKIM and DMARC, filter attachments and train users to report — not just avoid — suspicious emails.
9. Have a rehearsed response plan
Know who decides, who to call, how to isolate systems and how to communicate. Run a tabletop exercise at least annually.
10. Know your crown jewels
Identify the systems and data whose loss would stop the business, and prioritise every control above around them.
Want to know where you stand? Take our free Security Readiness Assessment or book a free audit.