Ransomware Protection: A 10-Step Defense Plan for SMBs

Ransomware protection for small and mid-sized businesses is not delivered by a single product but by a layered plan: shrink the internet-facing attack surface, protect identities with multi-factor authentication, deploy behavior-based detection on endpoints, keep an immutable backup and write down in advance what happens during an attack. This guide walks through a 10-step defense plan with the reason, tooling and owner for every step.

Why is ransomware the biggest threat to SMBs in 2026?

Ransomware is the biggest threat to SMBs because attackers now look at how vulnerable a target is, not how large it is. According to the Verizon DBIR 2025, ransomware appeared in 88% of breaches at small and mid-sized businesses versus 39% at large organizations, and it was present in 44% of all breaches reviewed in the report.

The gap is structural rather than technical. A typical SMB has a single IT person, a flat network, a remote desktop exposed to the internet and backups sitting on the same server as production data. Large enterprises, by contrast, run security operations teams, segmented networks and regular audits. Attackers go for the easiest door; the detailed findings are available in the Verizon DBIR.

The same report also contains encouraging data: 64% of victims refused to pay the ransom, up from 50% two years earlier. What the organizations that did not pay have in common is a backup the attacker could not reach and a response plan written in advance. In other words, ransomware protection does not mean blocking every attack; it means being able to recover without paying when an attack succeeds.

Turkey is no exception. Bitdefender's June 2026 Threat Report notes that ransomware and phishing activity remain at high levels globally and that companies in Turkey are directly targeted by phishing campaigns. Encrypting servers that hold personal data is also a data breach under Turkish data protection law (KVKK) that triggers notification duties; we cover that dimension in our KVKK technical measures checklist.

How does a ransomware attack unfold?

A modern ransomware attack does not happen in one click; it is a chain that runs for days: initial access, credential theft, lateral movement across the network, deletion of backups, data exfiltration and, finally, encryption. Every link offers a chance to detect and stop the attack, and the defense plan is built around these links.

In our field experience, the attack chain follows almost the same order in every case:

1. Initial access: a phishing attachment or link, RDP exposed to the internet, an unpatched VPN appliance or a stolen password. The #StopRansomware Guide updated by CISA and partner agencies in October 2023 lists patching VPNs and network devices and enforcing MFA on all VPN connections among its first measures.
2. Persistence and credential theft: the attacker harvests local administrator accounts and domain credentials, often with off-the-shelf remote management tools.
3. Lateral movement: on an unsegmented network, the attacker reaches every system from the file server to the virtualization host.
4. Targeting backups: network-attached backup repositories are deleted or encrypted. This step is the real reason victims end up paying.
5. Data exfiltration (double extortion): customer lists, contracts and personal data are copied out before encryption and victims are threatened with publication.
6. Encryption and ransom note: the last link. By the time encryption starts, the attacker has often been inside the network for weeks.

This sequence sets the defense priorities: email and identity security break the first link, EDR and segmentation the middle ones, and an immutable backup the last one. The CISA #StopRansomware Guide follows the same logic, recommending offline encrypted backups, SMB hardening and a zero trust architecture.

The 10-step defense plan for SMBs

The 10-step ransomware defense plan is ordered to deliver the highest impact with the fewest resources: inventory, patch management, MFA, email security, firewall and segmentation, EDR, least privilege, immutable backup, centralized logging and an incident response plan. The first five steps stop the attack from starting; the last five stop it from spreading and causing lasting damage.

The table below summarizes each step in one row. The "Owner" column is there as a reminder that a plan without owners stays on paper.

Step 1: Asset inventory and risk map

Everything starts with knowing what you protect. Servers, clients, network devices, cloud accounts and third-party access are gathered into a single list, and critical assets are flagged by asking: "What happens if this system is down for three days?" The most common gap we find in projects is an old server or camera recorder that is not in the inventory but is still exposed to the internet.

Step 2: Patch management and reduced exposure

Every internet-facing service is a door. RDP is never exposed directly to the internet; firmware on VPN appliances and firewalls is tracked against vendor advisories; patches are distributed to clients and servers from a central tool. Manual patching tends to slip within months, so the tool's report must reach management on a regular schedule.

Step 3: Multi-factor authentication

MFA is the cheapest and most effective step. Priority order: VPN and remote access, email and Microsoft 365, server admin accounts, firewall management interface. Enabling MFA only for "important" users is not enough; attackers usually start from the least protected account.

Step 4: Email security and user awareness

Phishing keeps getting more personal. An email security gateway detonates attachments in a sandbox, checks links at click time and flags lookalike domains. On top of the technical controls, a short phishing simulation every quarter builds the habit of reporting suspicious messages.

Step 5: Next-generation firewall and network segmentation

On a flat network, one compromised client means access to every server. Servers, clients, guest Wi-Fi, cameras and IoT devices are placed in separate VLANs, and traffic between them passes through firewall policy. IPS and application control profiles block known exploit signatures at the edge. To choose the right appliance, see our SMB firewall selection guide; for product details, visit our FortiGate solution page.

Step 6: EDR/XDR on endpoints

Traditional antivirus recognizes known file signatures, while ransomware is recompiled for every campaign and often abuses legitimate system tools. EDR looks at behavior: mass file encryption, shadow copy deletion and suspicious PowerShell calls are stopped instantly and the device is isolated from the network. We compare the levels in our article on the difference between EDR, XDR and MDR; on the product side, FortiEDR stands out in production environments with legacy operating systems.

Step 7: Least privilege and admin account discipline

Local admin rights are removed from users; the IT team uses a standard account for daily work and a separate admin account for administration. Office macros are blocked by default, SMBv1 is disabled and access to administrative shares is restricted. This step needs discipline rather than a product.

Step 8: 3-2-1-1-0 backup with an immutable copy

Backup is the insurance policy of the plan, covered in detail in the next section. The short rule: at least one copy must sit in storage the attacker cannot reach, delete or modify, and restores must be tested regularly. Data in Microsoft 365 must be backed up too, as we explain with the shared responsibility model in our Microsoft 365 backup article.

Step 9: Centralized logging and monitoring

Attackers leave traces weeks before encryption: VPN logins at night, unusual admin sessions, mass file reads. If firewall, server and EDR logs are not collected centrally, nobody reads those traces. A central log platform such as FortiAnalyzer with simple alert rules provides that visibility; without 24/7 capacity in-house, the job is handed to an MDR service.

Step 10: Incident response plan and restore drills

The plan is written in a calm week, not on the night of the attack: who calls whom, which system is isolated first, the restore order from backup and who prepares the regulatory notification. At least once a year, a real restore drill is performed and timed. An untested backup is an assumption, not a backup.

What is the 3-2-1-1-0 backup rule and why is an immutable copy essential?

The 3-2-1-1-0 backup rule requires three copies of data on two different media, one copy off-site, one copy offline or immutable, and restore tests that complete with zero errors. The last two elements, added to the classic 3-2-1 rule, were developed specifically against ransomware.

The first job of a ransomware crew is to find the backups. A backup folder on a network share, a backup server joined to the same domain or a cloud repository with a compromised account are all deleted before encryption. An immutable copy solves this by design: during the defined retention period, the backup cannot be deleted or overwritten, not even with an administrator account.

In our projects we implement this rule with Acronis Cyber Protect Cloud: backup, immutable cloud storage and active anti-ransomware protection come together in one agent, and adding a disaster recovery (DRaaS) scenario for critical servers can bring recovery time down to hours. Whichever tool you choose, the test is the same: if a backup can be deleted with an admin account, an attacker can delete it too.

The first 24 hours of an attack: what to do and what not to do?

In the first 24 hours of a ransomware attack the priority is to stop the spread, preserve evidence and bring in the right people: isolate affected systems from the network, do not power devices off, do not contact the attackers, keep the logs, and start restoring only after the environment is confirmed clean.

1. Isolate, do not shut down: unplug the network cable of affected devices or quarantine them with EDR. Shutting down wipes forensic evidence in memory.
2. Protect the backup infrastructure: immediately restrict access to the backup server and cloud repository, and confirm that the immutable copy is intact.
3. Reset credentials: change domain admin passwords, VPN accounts and service accounts from a clean device.
4. Collect evidence: export firewall, VPN, server and EDR logs; keep the ransom note and sample encrypted files.
5. Trigger notification duties: if personal data is affected, under KVKK Board decision 2019/10 of 24 January 2019 the breach must be reported to the Board within 72 hours of discovery. Verify the current legislation and the Board's official guidance for deadlines and procedure.
6. Return to a clean environment: restoring before the attacker's initial access point is closed means being encrypted again the same night. Root cause first, then restore.

Paying does not guarantee the data comes back, does not prevent leaked data from being published and puts the organization on the target list for the next campaign.

How does Sora Yazılım implement this plan at SMBs?

Sora Yazılım prioritizes the 10-step plan according to each SMB's existing infrastructure: first the exposed surface and identity, then segmentation with FortiGate, endpoints with FortiEDR or Bitdefender, immutable backup with Acronis and finally managed monitoring. As an independent solution partner, we deliver a working plan, not just a product.

The situation we see most often in the field is an SMB that bought a firewall and an antivirus but left both on default settings. That is why we always start with a short discovery: open ports, MFA coverage, where the backups live and the date of the last restore test. The answers to these four questions decide which step of the plan comes first.

We handle project, procurement, installation and managed services from a single point. For businesses without an IT team, monitoring continues as a managed service; teams that have in-house IT receive full documentation and handover.

Frequently Asked Questions

Does paying the ransom bring the data back?

There is no guarantee. Decryptors often work partially or fail, leaked data may still be published and organizations that pay are targeted again in later campaigns. According to the Verizon DBIR 2025, 64% of victims refused to pay; an immutable backup and a tested restore are what make that possible.

Is EDR really necessary if we already have antivirus?

Yes. Antivirus recognizes known signatures, while ransomware is recompiled for each campaign and abuses legitimate system tools. EDR watches behavior, stops mass encryption immediately and isolates the device. See our article on the difference between EDR, XDR and MDR for a detailed comparison.

Can our Microsoft 365 data be hit by ransomware?

Yes. OneDrive and SharePoint files can be encrypted through a compromised account, and the sync client carries local encryption to the cloud. Under Microsoft's shared responsibility model, backing up the data is the customer's job, so a separate Microsoft 365 backup is essential.

What is an immutable backup?

It is a backup copy that cannot be deleted or overwritten during a defined retention period. Even if an administrator account is compromised, the copy stays protected. It is implemented with time locks on cloud object storage or offline disk rotation and corresponds to the second "1" in the 3-2-1-1-0 rule.

Does a ransomware attack have to be reported under KVKK?

Yes, if personal data is affected. KVKK Board decision 2019/10 requires the breach to be reported to the Board within 72 hours of discovery, and affected individuals must also be notified. Verify the current legislation and the Board's official guidance for deadlines, procedure and exceptions.

How long does it take to implement this plan?

Most steps start with existing infrastructure: closing RDP, enabling MFA and removing local admin rights can be done in the first week. EDR, segmentation and immutable backup are projects of a few weeks, while centralized logging and drills form a continuous operating cycle.

Conclusion

Ransomware protection is not a product but a plan with named owners. The Verizon DBIR 2025 shows that SMBs are the most heavily hit segment, while the rising share of victims who refuse to pay proves that preparation works. Shrink your exposed surface, protect identities with MFA, deploy EDR on endpoints, make at least one backup copy immutable and write your response plan on a quiet day. We have ranked the budget priorities in our 2026 cybersecurity budget article.

To see together where your current infrastructure stands on these 10 steps, get in touch with us; in a free discovery call we map your exposed surface, backup setup and priorities, and prepare a proposal tailored to your needs.