What Is Ransomware? A 7-Layer Defense Against Encrypting Malware

A fake shipping email opened by the accounting manager can lead to every company file being encrypted overnight. The team arriving at the office in the morning sees only the ransom note on their screens. This scenario has become a real picture in Turkish SMEs week after week.

In this article we examine what ransomware is, how it spreads, and a 7-layer defense strategy you can apply at SME scale. The audience is IT managers, office leads, and every business owner who does not consider cybersecurity "an enterprise problem."

What Is Ransomware, and How Does It Work?

Ransomware is a type of malware that encrypts files on a computer, server, or network, depriving the user of their data. The attackers typically demand a ransom in cryptocurrency in exchange for the decryption key. New-generation attacks use a double extortion model: data is exfiltrated before encryption, with the added threat "pay or we will leak your customer data."

The Typical Attack Path

1. Initial access: Phishing email, exposed RDP, unpatched vulnerability, or weak VPN
2. Privilege escalation: Reaching domain accounts, network discovery
3. Lateral movement: Spreading to other servers and clients
4. Data exfiltration: Copying sensitive files to attacker servers
5. Encryption: Locking down all targeted files
6. Ransom note: Payment instructions on the screen, countdown timer

Ransomware Infection Vectors

Attackers usually do not bring complex zero-day exploits; they enter through known, easy-to-close open doors.

1. Email — the Most Common Vector

Fake invoices, payment receipts, shipping notifications, and CV-looking attachments. They arrive inside Word, Excel, PDF, or compressed archives (ZIP, RAR). Office macro content and PDFs using HTML smuggling are the most common formats.

2. Weakly Configured Remote Access

Internet-exposed RDP (port 3389), VPNs without two-factor authentication, and remote-support tools are the first targets of automated scanners. Even with a strong password, without MFA you remain weak against brute-force attacks.

3. Unpatched Systems

Old Windows versions, unpatched firewall software, forgotten NAS firmware widen the attack surface. A known vulnerability is typically being actively exploited within 72 hours of public disclosure.

4. Privilege Sprawl

If every employee has full rights on shared folders, ransomware infecting a single computer can encrypt hundreds of users' files. Daily use of domain admin accounts is another frequent mistake.

Why Are the First 30 Minutes of an Attack Critical?

Decisions made in those first 30 minutes determine whether recovery takes hours or days.

Do NOT Do

• Panic-reboot computers: Encryption may speed up; forensic evidence in RAM is wiped
• Immediately reformat: You lose evidence; without knowing which variant infected you, you cannot find the right decryption tool
• Post on social media: The attackers see the brand is panicking and raise the ransom

First Response Steps

1. Network isolation (first 5 minutes): Unplug the Ethernet on affected devices, disable Wi-Fi, drop VPN connections
2. Protecting backup systems: Disconnect the backup NAS or cloud backup account — the attacker may not have reached your backups yet
3. Scope assessment: Which account is affected? Who opened which email? Which servers are encrypted? When was the last clean backup?
4. Call professional help: Your incident-response team or MSP should be called immediately
5. Communication chain: Management, legal counsel, insurance company are informed

The Invisible Risks of Paying the Ransom

Even if you pay, the decryption key may not work, you may get a half-broken tool, and the data-leak threat does not disappear because the data was already exfiltrated. On top of that, paying puts you on the "customer who pays" list for future attacks.

The 7-Layer Defense Against Ransomware

No single measure fully prevents ransomware. Effective defense is layers stacked on top of each other.

1. Email Security

Configure SPF, DKIM, DMARC records correctly for your domain. A corporate mail gateway, or the built-in security features of M365/Workspace, should enable additional scanning, attachment-type restrictions, and suspicious link rewriting. Sandbox-based attachment analysis comes with enterprise licenses.

2. Endpoint Security

Classic antivirus is signature-based and detects new variants late. EDR (Endpoint Detection & Response) or XDR solutions do behavior analysis: a process encrypting hundreds of files in seconds, deleting shadow copies (VSS), and similar events are blocked in real time. At SME scale, Microsoft Defender for Business, Bitdefender GravityZone, and SentinelOne are reasonable choices.

3. Backup Strategy — The 3-2-1 Rule

• 3 copies of the data (production + 2 backups)
• 2 different media (local NAS + cloud)
• 1 copy offline or immutable — a location ransomware cannot reach

Backups are not backups until they are tested. Run at least one restore drill per month and measure whether RTO and RPO targets are met.

4. Access Control — Least Privilege

Every user should have access only to the folders their job requires. The "Everyone — Full Control" combination on shared folders should be removed. Admin accounts should not be used day to day; a separate admin account should only be used when needed.

5. Two-Factor Authentication (MFA)

MFA should be mandatory on VPN, email, cloud panels, RDP, and remote access accounts. Prefer an authenticator app or a FIDO2 hardware key over SMS. Microsoft's analyses indicate that MFA blocks around 99% of account takeover attacks.

6. Patch Management

Windows, server software, firewall firmware, NAS, accounting, and ERP software should be patched regularly. Emergency patches within 48 hours; routine patches go through a test environment and are rolled out in monthly maintenance windows.

7. Monitoring and Log Management

Firewall logs, failed login attempts, suspicious network traffic, EDR alerts, and domain controller event logs should be reviewed regularly. A SIEM or managed MDR service makes "detect within half an hour" possible at SME scale.

A Practical Checklist for SMEs

Area	Action	Frequency
Inventory	List of all devices (OS, user, software, remote access)	Quarterly
Permissions	Review folder permissions, close old accounts	Monthly
Backup test	Real restore drill on critical systems	Monthly
Training	10 phishing examples, reporting procedure	Every 6 months
Patching	Emergency + routine patch rollout	Monthly
MFA audit	Any account without MFA?	Monthly
Drills	Scenario-based incident response drill	Twice a year

When Do You Need Professional Support?

If any of the following applies, professional cybersecurity support is the most cost-effective investment for the business:

• You use a file server, NAS, or enterprise ERP/accounting software
• You have remote staff or multiple locations
• External access is provided via VPN, RDP, or a cloud panel
• You process personal data in scope of KVKK
• IT is handled by a single person in the office (no backup)

Yamanlar Bilişim provides SME-scale security audits, backup planning, firewall configuration, endpoint protection, and post-incident recovery support.

Frequently Asked Questions

Conclusion

The defense against ransomware lies in a layered architecture set up before the attack. Email hygiene, EDR, tested 3-2-1 backups, strict permission management, MFA, regular patching, and monitoring — when these seven layers stack, the attack's chance of success drops dramatically.

No single measure gives 100% protection; but a correctly built defense turns the worst case from a "catastrophe" into a "controlled incident." Yamanlar Bilişim helps you build these seven layers in practical steps at SME scale.