Ransomware keeps working because most environments still have multiple weak points: exposed endpoints, weak identity controls, inconsistent backups, and users left to identify phishing on their own. Effective protection comes from control layers that reinforce each other, not tools deployed in isolation.
Layer 1: Endpoint Protection and Detection
Modern endpoint detection and response (EDR) identifies suspicious behavior before file encryption spreads across the network. Legacy antivirus alone is not sufficient against ransomware that uses legitimate system tools, delayed execution, and fileless techniques to avoid simple signature detection.
- Deploy appropriately licensed endpoint protection on supported managed devices; document compensating controls and expiry for exceptions
- Enable behavioral-based detection alongside signature matching for coverage of advanced variants
- Enforce tamper protection so the security agent cannot be disabled by an attacker mid-intrusion
- Establish an alert triage SLA so detections receive a response within hours, not days
- Review endpoint compliance and patch status weekly to close unmanaged device gaps before they are exploited
Layer 2: Email Security and User Awareness
Email is one important attack path alongside exposed services, stolen credentials, and exploitable systems. Better filtering and link protection reduce how often malicious content reaches users. Awareness training reduces how often that content succeeds even when it does land.
- Enable Safe Links and Safe Attachments in Microsoft Defender for Office 365
- Configure anti-phishing policies targeting executive name impersonation and domain spoofing
- Block high-risk attachment types and disable macro execution from untrusted external sources
- Run phishing simulations quarterly with focused follow-up training for repeat clickers
- Include email threat trend data in quarterly leadership reporting so awareness investment is visible
Layer 3: Backup That Can Actually Recover
Backups only matter when they are monitored, tested, and isolated from the same attack that encrypted production. A backup that the attacker can also reach or modify is not a real recovery option.
- Maintain immutable or air-gapped backup copies that cannot be modified through compromised credentials
- Validate backup job completion daily and alert on any failure immediately without waiting for manual checks
- Test restoration of business-critical systems at least once per quarter with documented results
- Define recovery priority order and recovery time objectives by system and business impact tier
- Store restoration runbooks offline so they remain accessible during an active incident
Layer 4: Identity Controls and Privilege Governance
MFA, least privilege, and clean administrative boundaries make it significantly harder for ransomware to escalate privileges and spread after an initial foothold. Identity is where most attacks expand from a single infected endpoint to a business-wide event.
- Protect human user accounts with phishing-resistant MFA where supported; separately control workload identities and block direct shared-mailbox sign-in
- Apply Conditional Access to block high-risk sign-ins and unmanaged device access paths
- Implement Privileged Identity Management for time-limited, approval-gated admin elevation
- Remove stale accounts and unnecessary privileged access on a defined monthly review schedule
- Audit service accounts and shared credentials that could enable lateral movement if compromised
Incident Response Readiness
Prevention controls reduce probability. Response readiness controls blast radius when an attack still gets through. Teams that have practiced their response perform significantly better under pressure than teams that have not.
- Define an incident commander role with explicit decision authority before an event occurs
- Document the containment workflow: isolate affected assets, preserve forensic evidence, notify stakeholders
- Maintain an out-of-band communication channel for coordination when primary systems are affected
- Run a tabletop exercise at minimum twice a year with both leadership and operations participants
- Track detection-to-containment time as a KPI and set improvement targets each quarter
Monthly Resilience Review Checklist
- Confirm all four control layers are operational and actively monitored
- Review endpoint compliance and patch currency across the fleet
- Validate the most recent backup restore test result and remediate any failures
- Check privileged access changes, new exceptions, and aging grants since the last review
- Confirm phishing simulation schedule is on track for the current quarter
Use the Checklist as a Scope Conversation
Each layer needs a named operator, supported systems, tested recovery or exception handling, and agreed staffed coverage. Conditional Access, risk-based identity policies, PIM, and Defender capabilities require the applicable licenses; do not treat them as universal features of every Microsoft plan.
For the response exercise and restoration sequence, continue to the deeper Microsoft ransomware playbook. Human-user MFA, shared-mailbox delegated access, workload identities, and emergency access require different controls.