Cybersecurity Guide

How to Protect Your Indian Business from Ransomware — A Practical Guide

Ransomware attacks on Indian businesses increased by over 200% in recent years. A ransomware attack encrypts all your company files — customer data, financial records, emails — and demands payment (typically in Bitcoin) to decrypt them. Many Indian SMBs pay the ransom or lose their data entirely. This guide shows you how to prevent an attack and recover if one occurs.

• Deploy Endpoint Security on Every Device: Free antivirus is not sufficient protection against modern ransomware. Business-grade endpoint security like Sophos Intercept X uses AI to detect ransomware behaviour and stop it in seconds — even if it's never been seen before. It also reverses any files encrypted before detection. Install on every laptop, desktop, and server in your company.
  • Replace free antivirus with business-grade endpoint security
  • Sophos Intercept X, CrowdStrike, or Microsoft Defender for Business
  • Include all servers — not just employee laptops
  • Enable automatic updates for threat definitions
  • Central management console to monitor all devices
• Implement the 3-2-1 Backup Rule: The only guaranteed recovery from ransomware is a clean backup. The 3-2-1 rule: 3 copies of data, on 2 different media, with 1 copy offsite (ideally in the cloud). Back up to AWS S3 or Azure Blob Storage with versioning enabled — so even if ransomware encrypts your local backup, you have a cloud copy that cannot be affected. Test your backup restore monthly.
  • 3 copies: original + local backup + cloud backup
  • Cloud backup to AWS S3 or Azure with versioning
  • Immutable backups — cannot be encrypted or deleted
  • Test restore every month — backup means nothing without restore
  • Backup your critical data every 4-8 hours
• Keep All Software Updated: Ransomware commonly exploits known vulnerabilities in Windows, Office, and other software. The WannaCry ransomware that hit Indian companies in 2017 exploited a Windows vulnerability that Microsoft had patched months earlier. Enable automatic Windows updates, keep Office updated, and regularly patch server software. Use a patch management tool for larger organisations.
  • Enable automatic Windows updates — never delay them
  • Keep Microsoft Office and browsers updated
  • Patch servers monthly
  • Replace Windows 7 machines immediately — no security patches
  • Patch management tool for 20+ devices
• Train Employees to Recognise Phishing: Over 90% of ransomware enters through phishing emails — fake emails that trick employees into clicking a malicious link or opening an infected attachment. In India, common phishing lures are fake courier delivery notifications, income tax notices, and fake invoice PDFs. Train every employee to verify email senders, never open unexpected attachments, and report suspicious emails to IT.
  • Run phishing simulation tests monthly
  • Teach employees to check email sender domain carefully
  • Never open unexpected invoice or document attachments
  • When in doubt, call the sender to verify
  • Report suspicious emails to IT immediately — don't just delete
• Set Up a Next-Gen Firewall: A network firewall blocks malicious traffic from entering your office network and prevents ransomware from communicating with attacker-controlled servers (C2 communication). Sophos XGS Firewall or Fortinet FortiGate are recommended for Indian businesses. The firewall should be configured to block known malicious domains and inspect encrypted HTTPS traffic.
  • Next-gen firewall required — basic router is not enough
  • Block C2 communication to cut off active ransomware
  • Enable DNS filtering
  • Configure IPS (Intrusion Prevention System)
  • Review firewall logs weekly
• Have an Incident Response Plan: Despite all precautions, a breach can still happen. Know what to do: (1) Isolate affected machines immediately — unplug from network. (2) Do not pay the ransom — it encourages more attacks and doesn't guarantee file recovery. (3) Call your IT partner (National IT Service) immediately. (4) Report to CERT-In within 6 hours (mandatory under CERT-In 2022 directives). (5) Restore from clean backups.
  • Print your incident response plan — you may not have internet during an attack
  • Have National IT Service on speed dial
  • Do not pay the ransom
  • Report to CERT-In within 6 hours
  • Restore from cloud backup — verify it's clean before restoring

Worried about ransomware hitting your business? National IT Service offers free cybersecurity assessments. We'll identify your vulnerabilities before attackers do.