Ransomware Protection: How Indian Enterprises Can Defend Themselves

Ransomware attacks against Indian enterprises have increased by over 200% in the past three years. Manufacturing plants have been shut down, hospitals have lost access to patient records, and financial institutions have faced operational crises — all because of ransomware. The average ransom demand against Indian enterprises now exceeds ₹2 crore, with recovery costs often 5–10 times the ransom itself.

This guide provides a practical, comprehensive ransomware protection framework for Indian enterprises — covering the prevention controls, backup strategies, and recovery capabilities that collectively create ransomware resilience.

How Modern Ransomware Works

Understanding the attack lifecycle is essential for building effective defences. Modern ransomware attacks follow a predictable pattern called the ransomware kill chain:

Stage	Description	Defender's Window
Initial Access	Attacker gains entry through phishing, RDP brute force, or VPN vulnerability	Prevention — strongest opportunity to stop the attack
Persistence	Attacker installs backdoor to maintain access	Detection — SIEM and EDR can identify unusual activity
Lateral Movement	Attacker moves across the network to find valuable targets	Detection and Containment — network segmentation limits spread
Privilege Escalation	Attacker obtains administrative credentials	Detection — PAM and behavioural analytics can identify this
Exfiltration	Attacker steals data before encryption (double extortion)	Detection — DLP and network monitoring can identify large data transfers
Encryption	Attacker deploys ransomware payload and encrypts files	Recovery — backups determine whether payment is necessary
Extortion	Ransom demand with threat to publish stolen data	Recovery — the quality of backups and IR plan determines outcome

Ransomware Prevention Controls

1. Email Security

Since phishing is the most common ransomware delivery mechanism, email security is your first line of defence. Implement:

• Advanced email filtering with sandboxing for attachment analysis
• DMARC, DKIM, and SPF to prevent email spoofing
• Anti-phishing AI that detects impersonation and malicious links
• Attachment stripping for high-risk file types (.exe, .js, .vbs, .bat, .iso)

2. Vulnerability Management and Patching

Many ransomware attacks exploit known vulnerabilities in unpatched systems — particularly internet-facing services like VPN gateways, RDP, and web applications. Implement:

• Monthly patching cadence for standard systems; 24-hour patching for critical vulnerabilities
• Automated vulnerability scanning with prioritisation by exploitability and exposure
• External attack surface management to discover exposed systems
• Immediate patching of any vulnerability listed in CISA's Known Exploited Vulnerabilities catalogue

3. Multi-Factor Authentication

Credential theft is a primary initial access method. MFA on all externally accessible services — email, VPN, RDP, cloud portals, and administrative interfaces — eliminates a huge category of ransomware entry points.

4. Network Segmentation

Ransomware spreads laterally through flat networks. Micro-segmentation limits the blast radius by preventing malware from moving freely between network zones. Critical systems — production environments, backups, domain controllers — should be in isolated segments.

5. Endpoint Detection and Response (EDR)

EDR solutions use behavioural analysis to detect ransomware activity — rapid file encryption, shadow copy deletion, and unusual process behaviour — before the attack completes. EDR is essential because signature-based antivirus fails against modern ransomware variants.

The Backup Strategy That Saves You

If prevention fails, your backup strategy determines whether you pay the ransom. The 3-2-1-1-0 backup rule for ransomware resilience:

• 3 — Keep 3 copies of important data
• 2 — Store on 2 different media types
• 1 — Keep 1 copy offsite
• 1 — Keep 1 copy offline (air-gapped) — this is the critical ransomware-specific addition
• 0 — Zero errors on backup verification — test your restores regularly

The most important element is the offline, air-gapped backup. Ransomware operators actively seek and encrypt backup systems. An offline backup that ransomware cannot reach is the difference between a recoverable incident and a catastrophic one.

Backup testing is as important as backup creation. Organisations that discover their backups are corrupt or incomplete during a ransomware incident face the worst possible outcome — no usable backups and a ransom demand. Test backup restores quarterly.

Ransomware Response Plan

• 1. Isolate — Immediately disconnect affected systems from the network. Do not power them off — forensic evidence is preserved in memory.
• 2. Assess Scope — Identify which systems are encrypted, which are clean, and how the attacker entered.
• 3. Notify — Report to CERT-In within 6 hours as required. Notify management, legal, and PR teams.
• 4. Engage Forensics — Engage your pre-retained forensics firm to investigate the attack and preserve evidence.
• 5. Restore from Backups — Begin recovery from clean, verified backups. Rebuild affected systems from scratch if necessary.
• 6. Eradicate — Ensure the attacker's persistence mechanisms are removed before reconnecting systems.
• 7. Review — Conduct a post-incident review to understand how the attack succeeded and implement improvements.

Should You Pay the Ransom?

This is the most difficult question in ransomware response. The official advice from CERT-In, Interpol, and most cybersecurity authorities is: do not pay. Reasons include:

• Payment does not guarantee data recovery — decryptors provided by attackers are often slow, incomplete, or broken
• Payment funds further attacks against others
• Payment marks you as a willing payer — many organisations that pay are attacked again within 12 months
• Payment may violate sanctions — some ransomware groups are sanctioned entities

However, if your backup strategy has failed and the encrypted data is business-critical and irreplaceable, the practical calculus may differ. Legal and law enforcement consultation before any payment decision is essential.