Ransomware Prevention: A Defender's Playbook

A finance clerk gets an invoice email, opens the attachment, and a macro runs. Three days later the file server, the hypervisors, and the backup appliance are encrypted, and the operator is threatening to leak 400GB of exfiltrated data unless the company pays. Walk that incident backwards and you find a chain of missed chances: an email that should have been filtered, an account that should have had phishing-resistant MFA, a flat network that let one foothold reach everything, and backups that sat online where the attacker could reach them too.

That is the case for prevention. Ransomware is not a single event you block at the door; it is a campaign that unfolds in stages, and each stage is a control you either had or did not. The goal of ransomware prevention is not one silver bullet. It is to put a working control at every stage so that beating one does not mean beating all of them. This playbook organizes those controls the way attackers actually get in, prioritized by how often each vector is used, and maps them to the two frameworks defenders are measured against: the CISA #StopRansomware Guide and NIST IR 8374 Revision 1.

What ransomware prevention actually means

Prevention is the set of controls that stop ransomware from getting in, stop it from spreading once it does, and stop the attacker from having leverage when it lands. That last clause matters more than it used to. Modern operators do not just encrypt. They exfiltrate data first and threaten to publish it, a tactic CISA calls double extortion. So "prevention" that only protects availability, keep a backup and you can restore, no longer covers the threat. If the attacker already copied your data, a clean restore does not stop the leak.

A useful way to think about it: prevention spans three jobs, not one.

• Keep them out. Close the initial-access vectors: phishing, exposed remote services, stolen credentials, and unpatched vulnerabilities.
• Contain the blast radius. Assume one host will fall and make sure that one host cannot reach the file shares, the hypervisors, and the backups.
• Remove their leverage. Make recovery possible without paying (immutable, offline backups) and make exfiltration harder and noisier (segmentation, egress monitoring, least privilege).

NIST IR 8374 Revision 1, the Ransomware Risk Management Community Profile, organizes the same work against the six functions of the Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond, Recover. The controls below map onto those functions. The point of the mapping is not bureaucracy. It is that a prevention program with no Detect or Recover leg is not a prevention program, it is a wall with no one watching it and no plan for when it is breached.

Prioritize by how attackers actually get in

Most prevention guides hand you a flat list of ten tips. The problem with a flat list is that it implies every control matters equally. They do not. A small number of initial-access vectors account for most ransomware intrusions, so the controls that close those vectors deserve your attention first. The 2025 Verizon Data Breach Investigations Report found ransomware present in 44 percent of breaches, with stolen credentials, vulnerability exploitation, and phishing as the leading paths in.

Here is the entry-vector hierarchy and the control that closes each one.

Notice that two of the top three are about identity, not malware. The single highest-leverage prevention move in most environments is not a new tool. It is requiring phishing-resistant MFA on every account that can log in remotely, and removing the standing remote access that does not need to exist.

Keep them out: harden the entry vectors

Lock down identity and remote access

Credentials are the most common way in, so identity is where prevention pays the most. Require multi-factor authentication on every account, and prefer phishing-resistant MFA, FIDO2 security keys or passkeys, over SMS and push, which attackers defeat with prompt bombing and SIM swaps. CISA's guidance is explicit: use phishing-resistant MFA for email, VPNs, and access to critical systems.

Then shrink the remote attack surface. Remote Desktop Protocol exposed to the internet is one of the most reliable ransomware doors, because it offers an interactive login with no exploit required. Take RDP off the public internet entirely, put remote access behind a VPN or a zero-trust broker, enforce account lockout to defeat brute force, and disable accounts and credentials the moment they are no longer needed.

Patch what attackers actually exploit

Vulnerability exploitation is a top-three vector, and the fix is unglamorous: patch management on a schedule, with internet-facing and known-exploited vulnerabilities at the front of the queue. You cannot patch everything at once, so prioritize. CISA publishes a Known Exploited Vulnerabilities catalog precisely so defenders can patch the bugs that are being used in the wild before the rest. A vulnerability on an internet-facing system that already has a public exploit is a fire; a low-severity bug on an internal host is not.

Cut off phishing and malicious code execution

Phishing targets people, so the defense is partly technical and partly human. On the technical side: strong email filtering, attachment sandboxing, and blocking the file types that carry payloads. Disable Office macros from internet-originated documents, which removes one of the most common first-stage execution methods outright. Use application allowlisting so that even if a user runs something, only approved code executes. On the human side, run security awareness training that teaches people to recognize and report phishing, and make reporting a one-click action so suspicious mail reaches the SOC fast.

Contain the blast radius: limit how far it spreads

Keeping every attacker out forever is not realistic. The second job of prevention is making sure that when one host falls, it cannot take the enterprise with it. This is the difference between an incident and an outage.

• Enforce least privilege. Most ransomware spreads using a credential it stole on the first host. If that account is a local user with no rights elsewhere, the attacker is stuck. If it is a domain admin, the attacker owns everything. Limit who holds administrative rights, separate admin accounts from daily-use accounts, and remove standing privilege wherever just-in-time access can replace it.
• Segment the network. Flat networks are why one infected laptop becomes an encrypted data center. Network segmentation separates critical systems, so a foothold in the user VLAN cannot freely reach file servers, backup infrastructure, and hypervisors. Segmentation is also what stops self-propagating variants cold, because the worm has nowhere to spread to.
• Protect endpoint defenses from tampering. Operators with admin rights try to disable endpoint detection and response before they encrypt. Turn on tamper protection so they cannot quietly switch off the very tool meant to catch them.
• Monitor egress. Double extortion means data leaves before encryption fires. Watching for large or unusual outbound transfers, and restricting which systems can talk to the internet at all, makes exfiltration harder and gives you a detection signal before the encryptor runs.

Remove their leverage: backups that survive the attack

Recovery is what decides whether you pay. If you can restore quickly from backups the attacker never touched, the encryption half of the extortion loses its power. The catch is that attackers know this, so they hunt for and destroy backups first. Online backups reachable from the production network are not a recovery plan; they are another target.

The standard worth meeting is the 3-2-1 rule: three copies of your data, on two different media types, with one copy kept offsite. For ransomware specifically, extend it: at least one copy must be offline or immutable, so it cannot be altered or deleted even by an attacker with domain admin. CISA's guidance is to maintain offline, encrypted, immutable backups, and, critically, to test restoration regularly. A backup you have never restored from is a hope, not a control. The first time you find out a restore does not work should not be during an active incident.

Detect and respond: the prevention controls people forget

Prevention is not only about walls. NIST IR 8374 Revision 1 maps ransomware risk management across all six CSF functions, and Detect, Respond, and Recover are half of them. The reason is that ransomware unfolds in stages, and every stage before encryption throws off signal: a credential dumped, an unusual login, a host enumerating Active Directory, a sudden spike in file modifications. Catching the movement is how you stop a single infection from becoming an outage.

Deploy endpoint detection and response with behavioral detection, not just signatures, so living-off-the-land tradecraft and mass-file-encryption behavior get flagged. Feed endpoint, identity, and network telemetry into a place where it can be correlated, and write detections for the early stages: credential dumping, anomalous remote logins, and rapid file renames or extensions changing en masse. Then make sure someone, or something, acts on those alerts fast.

Finally, write and rehearse an incident response plan before you need it. The plan names who isolates hosts, who pulls the network segment, who talks to legal and leadership, and how you recover from backups. Teams that have run the playbook contain the intrusion during the early stages. Teams improvising during the encryption stage do not.

A ransomware prevention checklist

Pulling the playbook into one actionable list, ordered by leverage:

1. Require phishing-resistant MFA on all remote and privileged access.
2. Remove internet-exposed RDP; put remote access behind a VPN or zero-trust broker.
3. Patch internet-facing and known-exploited vulnerabilities on a clock.
4. Filter email, sandbox attachments, and block macros from the internet.
5. Enforce least privilege and separate admin accounts from daily use.
6. Segment the network so a foothold cannot reach backups and hypervisors.
7. Keep offline or immutable backups, encrypted, offsite, and test restores.
8. Run EDR with tamper protection and behavioral detection.
9. Monitor outbound traffic for exfiltration before encryption.
10. Write and rehearse an incident response plan.

No single item on that list stops every attack. Together they force an attacker to beat the email filter, then find an unpatched system, then escalate privilege, then move laterally past segmentation, then reach backups they cannot encrypt, with a defender watching at every step.

The bottom line

Ransomware prevention is layered control placed where attackers actually operate. Close the top entry vectors first: phishing-resistant MFA and removed remote exposure address the credential and RDP paths, disciplined patching closes vulnerability exploitation, and email filtering plus training cut phishing. Contain spread with least privilege and network segmentation so one host cannot become an outage. Remove the attacker's leverage with offline, immutable, tested backups and egress monitoring, because double extortion means a clean restore alone is no longer enough. Back it all with detection and a rehearsed response, the half of the frameworks teams forget. The CISA #StopRansomware Guide and NIST IR 8374 Revision 1 say the same thing in more words: prevention is not a wall, it is depth, and depth is what turns a catastrophic attack into a contained incident.

Frequently Asked Questions

What is the most effective way to prevent ransomware?

There is no single most effective control, but the highest-leverage move in most environments is hardening identity: require phishing-resistant MFA on all remote and privileged access and remove internet-exposed remote services like RDP. Stolen credentials and exposed remote services are two of the top three initial-access vectors, so closing them blocks the most common ways in. Pair that with disciplined patching and offline backups for defense in depth.

Can backups alone protect against ransomware?

No. Backups protect availability, so you can restore instead of paying to decrypt, but modern ransomware uses double extortion: the attacker exfiltrates your data and threatens to publish it before encrypting. A clean restore does not stop a data leak. Backups remain essential, and must be offline or immutable and tested, but they are one layer, not the whole defense. You also need controls that prevent the intrusion and limit data theft.

How do immutable backups help against ransomware?

Attackers target backups first, because destroying them forces the victim to pay. An immutable backup cannot be altered or deleted for a set retention period, even by an account with full administrative rights. Combined with an offline or air-gapped copy, immutability means the attacker cannot reach or destroy your recovery point. Follow the 3-2-1 rule, three copies, two media types, one offsite, and extend it so at least one copy is offline or immutable, then test restores regularly.

What frameworks guide ransomware prevention?

The CISA #StopRansomware Guide gives practical, prioritized prevention and response guidance, including phishing-resistant MFA, patching known exploited vulnerabilities, and offline immutable backups. NIST IR 8374 Revision 1, the Ransomware Risk Management Community Profile, maps ransomware controls across the six NIST Cybersecurity Framework 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover. Together they frame prevention as layered defense, not a single control.

Why does network segmentation matter for ransomware prevention?

Most ransomware turns one infected host into an enterprise outage by moving laterally across a flat network. Segmentation separates critical systems, so a foothold in the user network cannot freely reach file servers, backup infrastructure, and hypervisors. It also stops self-propagating ransomware variants, which have nowhere to spread when segments are isolated. Segmentation is one of the most effective controls for limiting the blast radius of an intrusion that gets past the perimeter.

Does MFA stop ransomware?

MFA dramatically reduces ransomware that starts with stolen or weak credentials, which is a leading initial-access vector, but not all MFA is equal. Attackers defeat SMS and simple push MFA with prompt bombing and SIM swapping. Phishing-resistant MFA, such as FIDO2 security keys or passkeys, removes that weakness and is what CISA recommends for email, VPNs, and critical systems. MFA is necessary but works as part of layered prevention, not on its own.