A ransomware incident rarely starts with an encrypted file server. It starts with a convincing invoice, a reused password, an exposed remote service or an unpatched application that nobody realised was business-critical. By the time a ransom note appears, attackers may have already spent days or weeks mapping systems, stealing data and disabling recovery options. Effective ransomware protection is therefore an operational discipline, not a product purchased in isolation.
For Australian organisations, the stakes extend beyond downtime. A disrupted ERP platform, unavailable clinical system, locked construction files or inaccessible customer records can halt revenue, breach contractual obligations and trigger privacy, regulatory and reporting responsibilities. The objective is not simply to block every attack. It is to make compromise less likely, limit an intruder's reach and restore services on your own terms.
Why ransomware is a business continuity problem
Modern ransomware operators commonly use double extortion. They steal sensitive information before encrypting it, then threaten to publish the data if the victim will not pay. This means an organisation can face a data breach even where backups allow a relatively fast technical recovery.
Attackers also target the systems that make recovery possible. Backup consoles, identity platforms, virtualisation hosts, remote access tools and privileged administrator accounts are all high-value targets. If these foundations are compromised, restoring a few encrypted endpoints does little to return the business to normal.
That is why security leaders should assess ransomware risk through business impact. Which services must be restored first? Which data would cause the greatest harm if disclosed? Who can approve emergency decisions? How long can each process remain unavailable before customers, staff or suppliers are affected? These answers should shape security investment more than a generic list of features.
Ransomware protection needs layered controls
No single firewall, endpoint tool or backup platform can carry the full burden. A practical architecture uses overlapping controls so that a failure in one area does not become a company-wide outage. The Australian Cyber Security Centre's Essential Eight provides a useful benchmark, but the controls must be applied in a way that reflects your environment, workforce and risk profile.
Reduce the paths attackers use
Email remains a common delivery route, but it is not the only one. Remote access, cloud identities, third-party connections and unpatched internet-facing services all require attention. Start by maintaining an accurate view of externally exposed systems and remove services that do not have a clear operational purpose.
Multi-factor authentication should protect remote access, administrative accounts, cloud applications and other high-impact systems. It is particularly valuable where passwords have been reused, phished or leaked. However, not all MFA methods provide equal resistance to modern phishing. Organisations handling sensitive data or privileged access should consider phishing-resistant methods where practical.
Patch management deserves the same operational rigour as finance or payroll. Prioritise known exploited vulnerabilities, externally accessible systems and software that processes sensitive information. Some legacy applications cannot be patched immediately, particularly in industrial, healthcare or specialised environments. In those cases, isolate the asset, restrict access, monitor activity and document an upgrade or replacement path rather than accepting permanent exposure.
Contain an attacker before encryption spreads
Network segmentation is one of the clearest ways to reduce ransomware blast radius. Users, servers, guest networks, operational technology, backup infrastructure and management interfaces should not all communicate freely. Restrict traffic to what each service genuinely needs, then monitor for deviations.
A next-generation firewall can apply application awareness, intrusion prevention, web filtering and encrypted traffic inspection at key boundaries. Proper design matters more than simply switching every feature on. Inspection policies need appropriate sizing, tested exceptions and a clear understanding of where encrypted traffic can be safely examined without creating unnecessary performance or privacy issues.
Endpoint detection and response adds another layer by identifying suspicious behaviour on devices, such as unusual credential use, remote execution, rapid file changes or attempts to disable security tools. The value comes from both detection and response. A security team needs defined authority to isolate a device quickly, investigate affected accounts and preserve evidence. Alerts without an ownership model become background noise.
Protect identities and privileged access
Identity is often the shortest route to widespread access. An attacker with a domain administrator account or cloud tenant administrator role may not need to exploit every machine individually. Separate daily user accounts from privileged administration accounts, minimise standing privileges and review administrator group membership regularly.
Service accounts also warrant close attention. They often have broad access and long-lived credentials, yet may sit outside normal employee offboarding processes. Use managed identities or credential vaulting where available, rotate secrets, and remove accounts that no longer support an active service.
Logging from identity providers, firewalls, endpoints and critical servers should feed into a monitoring process that somebody owns. A central log platform is useful, but only if it collects meaningful events, retains them for an appropriate period and supports investigation. For smaller IT teams, managed detection and response can be more realistic than trying to staff continuous monitoring internally.
Backups must be designed for a hostile event
Backups are indispensable, but their presence is not proof of recoverability. Ransomware operators understand backup products and increasingly seek administrative credentials, delete recovery points or encrypt data stores before launching the visible part of an attack.
Use multiple copies of critical data, stored on different media or platforms, with at least one copy isolated from normal production credentials. Immutability can prevent authorised or unauthorised changes for a defined retention period, but it must be configured carefully. A backup that is immutable for too short a period, or inaccessible when needed, provides false confidence.
Recovery testing is where plans become credible. Test the restoration of a critical application, not just an individual file. Confirm that the recovered server can authenticate users, connect to dependent services and process real work. Measure the elapsed time and compare it with the business's recovery objectives. If restoring your core system takes three days but the business can only tolerate eight hours, the gap requires investment or a revised continuity plan.
Keep copies of recovery runbooks available outside the primary network. During an incident, staff may lose access to file shares, collaboration platforms and password systems. Printed emergency contacts, protected break-glass credentials and pre-agreed communications processes are unglamorous controls that can save valuable hours.
Build an incident response plan people can use
A ransomware response plan should be concise enough for an on-call team to follow under pressure. It needs technical steps, but it also needs decision-making structure. Define who can isolate systems, engage external responders, notify insurers, approve customer communications and involve legal or privacy advisers.
At minimum, the first response should cover these actions:
- isolate suspected devices and affected network segments without destroying evidence;
- preserve relevant logs, volatile data and suspicious files for investigation;
- disable or reset compromised accounts, tokens and remote access sessions;
- assess whether data was accessed or removed before encryption; and
- restore prioritised services only after the initial access path has been addressed.
Tabletop exercises are an efficient way to expose weaknesses before a real event. Walk executives, IT, security, communications and key business owners through a realistic scenario. Ask direct questions: can we identify the affected systems, who contacts our managed service provider, what can be restored by tomorrow morning, and what do we tell customers? The aim is not a perfect rehearsal. It is to find unclear responsibilities and technical assumptions while they can still be fixed calmly.
Choose technology that reduces complexity
Fragmented security tools can create blind spots, duplicated cost and slow incident response. For many organisations, a unified security platform spanning network, endpoint, identity-aware access, secure connectivity and centralised visibility is easier to operate than a collection of disconnected products. It can also help security teams correlate a suspicious login with firewall activity and endpoint behaviour faster.
That said, consolidation should not become a blind commitment to one vendor or an excuse to ignore design. Evaluate whether products integrate with existing systems, suit your branch and cloud architecture, meet performance requirements, and can be managed by the people you actually have. Enterprise-grade protection only delivers value when policies are tuned, licences are maintained and ownership is clear.
FortiSecure Store helps Australian organisations source genuine Fortinet solutions with certified advice on selecting, deploying and operating security controls that fit their operational and compliance requirements. The right outcome is not the largest bill of materials. It is a defensible design that protects priority services, supports recovery and remains manageable as the organisation grows.
Ransomware resilience is built long before an attacker appears on a screen. Start with the business services you cannot afford to lose, test the recovery you expect to rely on, and close the access paths that would let one compromised account become a business-wide disruption.