Ransomware protection

Ransomware protection for an organization is the set of everyday habits, settings and plans that make it hard for ransomware to get in, limit how far it can spread, and keep a clean copy of your work out of its reach. It is written for owners, office managers and finance leads who have been asked about ransomware by a board, an insurer or a client and want a calm, plain answer rather than a sales pitch. Canada Create is a Toronto agency that helps organizations across Canada review their readiness, close the gaps they choose to close and keep a written plan on file.

Contents

• What ransomware readiness means
• The usual ways ransomware gets in
• Prevention layers you can see
• Backups ransomware cannot reach
• A written ransomware readiness plan
• A tabletop walk-through with your managers
• Cyber insurance questionnaires
• The readiness review and a prioritized list
• How this fits with your other security work
• Privacy rules and breach records
• How a readiness engagement runs
• What ransomware readiness costs
• How to choose a partner for this work
• Your next step

What ransomware readiness means

Ransomware is software that locks or scrambles files and systems and then shows a demand for payment in exchange for access. Some groups also copy data before locking it and threaten to publish it. Readiness is not one product you install. It is a short list of decisions an owner makes about logins, updates, permissions, copies of data and who does what on a bad morning, written down so the decisions survive staff changes.

Three questions every owner can answer

A useful way to frame the subject is three questions. How would ransomware most likely reach us? If one laptop were locked tomorrow, what else could it touch? If our files were scrambled, which copy would we restore from, and has anyone tried? A readiness review turns those questions into a page of findings you can act on in order.

What it does not promise

No setup stops every attack, and no honest provider will tell you otherwise. The aim is to remove the obvious openings, keep damage contained to as little as possible, and make sure the organization can make clear decisions with good information. We never promise a recovery time, because that depends on what happened, what was copied and how the owner, counsel and insurer decide to proceed.

The usual ways ransomware gets in

Ransomware rarely arrives through anything exotic. It tends to come through ordinary doors that were left open, and knowing them helps the owner see why each later step matters.

Phishing email

A message that looks like an invoice, a courier note or a shared document asks someone to open an attachment or sign in on a fake page. The goal is often a password rather than an immediate infection. A bookkeeper who types a mailbox password into a convincing fake sign in page has handed over a key that can be used days later.

Exposed remote access

A remote desktop port opened years ago so a partner could work from the cottage, a vendor’s support tool left running on the reception computer, or an old VPN appliance that has not been updated can all be found by automated scanning on the internet. Remote access is useful; remote access that anyone can knock on with a guessed password is the problem.

Unpatched systems

Software makers publish fixes for weaknesses on a regular basis. Servers, firewalls, VPN gear and desktop software that miss those fixes stay open to tricks that are already widely known. The machine in the warehouse that nobody updates because it runs the label printer is a familiar example.

Reused or stolen passwords

When a staff member uses the same password for a shopping site and for company email, a leak at the shopping site can become a login to your mailbox. Passwords also travel in spreadsheets, sticky notes under keyboards and shared accounts that five people know.

Unmanaged vendor access

The firm that installed the phone system, the payroll provider’s support person, a former IT contractor: each may still hold a login. Nobody is accusing them of anything. The point is that access nobody remembers granting is access nobody watches.

Prevention layers you can see

Each layer below is something an owner can ask about and see evidence of, such as a setting, a report or a list. None of them is enough alone. Together they make each common doorway harder to use.

Multi factor authentication on email and remote access

Multi factor authentication asks for a second proof, such as a code or an approval on a phone, after the password. Turning it on for every mailbox and for every way into the office from outside is usually the first item on a readiness list, because it blunts the stolen password problem directly. Shared mailboxes and old service accounts deserve a look too, since they are often left out.

Patching on a schedule

Operating systems, browsers, office software, firewalls and VPN appliances all need updates applied on a known schedule, with a record of what was applied and what failed. The devices that cannot be updated, such as an old machine tied to a piece of equipment, get listed and isolated rather than forgotten.

Admin rights removed from daily accounts

When people sign in every day with an account that can install software and change settings, anything that tricks them inherits the same power. Separate admin accounts used only for admin tasks shrink what a single mistake can do. Owners sometimes resist this for themselves; it matters for owners most of all, since their accounts usually reach everything.

Endpoint protection on every device

Every laptop, desktop and server needs current protection that watches for harmful behaviour, not only known files, and someone who reads its alerts. Choosing and running that software is the job of our endpoint security service; for readiness, the question is simply whether every device is covered and whether alerts reach a person.

Email filtering

Filtering catches many harmful attachments and links before anyone sees them, and settings that mark messages from outside the organization help staff pause before acting. Filtering will miss some messages, which is why people still need to know what to do with the ones that get through.

Remote access closed or behind MFA

Any remote desktop or file sharing door open to the internet is either closed or moved behind a VPN or access gateway that requires multi factor authentication. Vendor access is given per person, written down, and switched off when the job ends.

Segmentation so one laptop cannot reach everything

If the reception computer can see the accounting server, the camera recorder and every shared folder, ransomware on that computer can see them too. Splitting the network so each group of devices reaches only what it needs keeps one infected laptop from becoming a whole office problem. Designing those segments and the firewall rules behind them belongs to our network security work; the readiness review simply notes whether it is in place.

Backups ransomware cannot reach

Ransomware often looks for backups first, because an organization with a clean copy has choices. A copy that sits on a drive mapped to every desktop, or in a storage account opened with the same admin password as everything else, can be locked along with the originals.

Offline or immutable copies

At least one copy should be either offline, meaning disconnected from the network when not in use, or immutable, meaning it cannot be changed or deleted until a period the owner sets has passed. Either way, the copy survives even if an attacker has admin access to the office systems.

Separate credentials

The account that manages backups should not be the same as the everyday domain or cloud admin account, should have its own multi factor authentication, and should be known to as few people as practical. Where the backup storage lives with an outside provider, that login stays in the organization’s name.

Restore tests

A backup that has never been restored is a hope. A readiness review asks for evidence of a recent restore: a folder, a mailbox, ideally a whole system brought back somewhere safe. The full design of copies, retention and restore schedules sits with our business data backup service, and website copies are covered on the Website Backup page in this group.

A written ransomware readiness plan

The written plan is the part owners most often lack. When a screen goes red, people tend to improvise, and improvising under stress leads to wiped evidence, missed calls and mixed messages to clients. A short, printed plan settles the decisions in advance.

Who decides

The plan names one person who makes the calls, usually the owner or managing partner, with a named backup if that person is away. It also says what that person can approve without waiting for anyone else, such as shutting off the internet connection or bringing in outside help.

Who is called

A one page contact sheet lists the cyber insurer’s claims line and policy number, legal counsel, whoever manages your IT, your bank’s fraud contact and key software vendors. The sheet is printed and kept off the network, since the network may not be available when it is needed.

How staff report a suspicious screen

Staff need one simple instruction: who to tell, by phone, the moment something looks wrong, such as a ransom note, files with strange names, or a sudden flood of password prompts. The plan also tells them what not to do, such as turning the machine off and on repeatedly or trying to fix it themselves.

What gets shut off first

The plan lists, in order, what may be disconnected to contain the damage: the affected device from the network, shared drives, remote access, sync clients. Writing this down in calm conditions avoids a panicked decision that destroys information the insurer or investigators would need.

Communication drafts

Short drafts for staff, clients and suppliers save hours of wording when everyone is tired. Counsel reviews them in advance, so the organization does not say too much or too little in the first messages.

The payment question

Whether to pay a ransom is a business and legal decision that belongs to the owner, working with legal counsel and the insurer. We do not advise on it. The plan simply records who takes part in that conversation, so it happens with the right people present.

A tabletop walk-through with your managers

A tabletop is a meeting around a table, not a technical test. The owner and managers walk through a realistic story, one development at a time, and talk through what they would do. It is the cheapest way to find the gaps in a written plan.

How a session runs

A facilitator sets the scene: on a Monday morning the office manager finds that shared folder files have odd extensions and a text file asks for contact. Every few minutes a new development arrives, such as the payroll run being due, a client asking why the portal is down, or the insurer asking for logs. The group decides what to do and who does it, and the facilitator notes where the answers were unclear.

Who should attend

The decision maker, the finance lead, whoever handles client communication, the operations lead and whoever manages IT. Bringing in counsel or the insurer’s contact for part of the session can be valuable, since they will be part of the real conversation.

What you take away

After the session you receive a written note of what went well, what was unclear and the changes to the plan, the contact sheet or the technical list that came out of it. Many organizations repeat the exercise with a different story when managers change or after major system changes.

Cyber insurance questionnaires

Many owners start thinking about ransomware because an insurer’s application or annual questionnaire asks pointed questions. Those forms are a fair checklist, and they deserve honest answers.

Questions owners often see

Typical questions ask whether multi factor authentication is on for email, remote access and admin accounts; whether backups are kept offline or immutable and tested; whether endpoint protection covers every device; whether staff receive security training; and whether remote desktop is exposed to the internet. The wording varies by insurer, so we work from the actual form you received.

Answering accurately

Ticking yes to a control that is only partly in place can cause trouble when a claim is made. A readiness review gives you the facts to answer accurately, and where the honest answer is no, a list of what it would take to change it. Decisions about the policy itself stay between you and your broker or insurer.

Keeping evidence

Screenshots of settings, a list of covered devices, a dated restore test record and a training attendance list are the kind of evidence an insurer may ask for. Keeping them in one folder, owned by the organization, saves a scramble later.

The readiness review and a prioritized list

The readiness review is where many engagements start. It looks at the entry points, the layers and the copies described above and produces a short, ranked list of what to fix first.

What the review looks at

Email sign in settings and multi factor coverage, remote access paths, patch status on servers and network gear, who holds admin rights, endpoint coverage, email filtering settings, how the network is split, where backups live and whether a restore has been tested, vendor accounts, and whether a written plan exists. It also looks at the organization’s own questionnaire answers, if an insurer has asked.

The prioritized list

Findings are ranked by how much they reduce exposure for the effort involved. An organization might see multi factor authentication on remaining mailboxes first, closing an exposed remote desktop second and separating backup credentials third, with larger projects such as network segmentation planned after. You decide what to do, in what order and with whom.

Testing only with written authorization

Any scanning or testing is carried out only on systems the organization owns or has written authorization to test, with that authorization signed before work starts. Where a deeper look is wanted, it can be arranged through scheduled vulnerability scanning or a separate penetration test, and a wider security audit suits owners who want every area scored, not only ransomware readiness.

How this fits with your other security work

Ransomware readiness pulls together pieces that each have their own page, and our cyber security services overview shows how they fit. Phishing practice and short staff lessons sit with security awareness training. Organizations that want alerts watched and investigated by people can look at managed detection and response. Mailbox and tenant settings are part of Microsoft 365 support, and day to day upkeep of devices and updates sits within managed IT services. Owners in regulated fields can also review security compliance work for card data and health information obligations.

Privacy rules and breach records

Ransomware that touches personal information can trigger legal duties, so the readiness plan should note them in plain words and name who will advise on them.

Federal private sector privacy law

Under PIPEDA, when a locked or copied file set includes personal information and the situation creates a real risk of significant harm, the organization must tell the Privacy Commissioner of Canada and the people affected. Every breach of security safeguards also has to be recorded, even one that never reaches that threshold. Your ransomware plan should name the person who keeps that record and who sits down with counsel to decide whether a report is due.

Quebec and health information

Quebec’s Law 25 adds its own obligations for organizations that handle personal information of people in Quebec. In Ontario, health information custodians such as clinics follow PHIPA, which has its own rules about protecting and reporting health information. If either applies to you, the plan names the person responsible and the advisers involved. This is a marketing observation, not legal advice.

How a readiness engagement runs

A free first conversation

We start with a call about the organization: how many people and locations, where email and files live, how people connect from outside, what backups exist, and whether an insurer, a client or a board has asked questions. If you have an insurance questionnaire, bring it.

A written proposal

You receive a written proposal for the readiness review, with fees quoted in writing and any written authorization needed for scanning set out clearly.

Review, findings and plan

The review produces the findings, the prioritized list and a draft readiness plan with the contact sheet. Where you want help with the fixes, each one is scoped and quoted in writing before it starts, and any software or storage is bought in the organization’s name.

Tabletop and ongoing reporting

A tabletop walk-through tests the plan with your managers. Where ongoing work is agreed, a monthly report shows progress on the list, patch and coverage status, restore test results and any plan updates.

What ransomware readiness costs

Ransomware readiness work is quoted in writing after the free conversation. Security software, backup storage and other subscriptions are paid to the vendor in the organization’s name and shown separately from our fees.

What drives the quote

• The number of users, devices, servers and locations in scope.
• How many cloud services hold business data, and how their sign in settings are managed today.
• Whether remote access, vendor access and admin accounts are documented or must be discovered.
• Whether the review includes scanning, which needs written authorization and more time.
• Whether you want a tabletop session, and how many managers or locations take part.
• How much of the prioritized list you ask us to carry out, and whether ongoing reporting is included.

A ten person accounting office with mail in the cloud and one file server is a smaller review than a distribution company with three warehouses, a shop floor full of older machines and a dozen outside vendors with logins.

How to choose a partner for this work

The partner who reviews your ransomware readiness will see how your organization is put together, so the questions are worth asking before any work starts.

• Who owns the accounts? The answer should be you, including backup storage, security software consoles and every admin login.
• Will I receive a written, prioritized list I can act on with anyone, not only with you?
• How do you handle written authorization before scanning or testing?
• Will you work from the insurer’s actual questionnaire and tell me plainly where the answer is no?
• Who facilitates the tabletop, and what do I receive afterward?
• Will you stay out of the payment question and leave it with me, counsel and the insurer?

Signs of a weak answer

Be careful with any provider who promises a product will stop all ransomware, quotes recovery times before knowing your systems, uses alarming headlines to rush a decision, or keeps the backup and admin logins in its own name. Calm, specific and written down is the standard to expect.

Your next step

Before the call, gather what you already have: the latest cyber insurance questionnaire, a rough list of who can sign in from outside the office, the name of whoever handles backups and the date of the last restore anyone remembers. With that, Canada Create can walk through your entry points, layers and copies in a free ransomware readiness review and send a written proposal afterward.

Call (416) 273-9030, Monday to Friday, 9 am to 6 pm, and Saturday, 10 am to 2 pm. After hours, our 24/7 AI agent answers the toll-free line, +1 (800) 808-9235, and we’ll follow up the next business morning.

You can also request a readiness review online. We reply within one business day.

Our office is at 126 Willowdale Avenue, Suite 3, Toronto, and we work with organizations across Canada.