Ransomware Protection: What Every SA Business Owner Must Know

Ransomware isn't just a problem for big corporations. In fact, small and medium businesses are the primary targets — precisely because they often lack the security measures that larger organisations have in place.

Why South African SMBs Are Targeted

Cybercriminals know that many local businesses operate with limited IT budgets and minimal security. The average ransom demand for SMBs ranges from R50,000 to R500,000 — and many pay because they don't have backups. According to Interpol's African Cyberthreat Assessment Report, ransomware remains the most significant cyber threat to African businesses, with South Africa being the most targeted country on the continent.

How Ransomware Gets In

Ransomware typically enters through:

• **Phishing emails** — An employee clicks a malicious link or opens an infected attachment
• **Remote desktop vulnerabilities** — Exposed RDP ports are a favourite entry point
• **Unpatched software** — Known vulnerabilities that haven't been updated
• **Drive-by downloads** — Visiting compromised websites

Your Protection Plan

1. Backups Are Your Safety Net

Follow the 3-2-1 backup rule: three copies of your data, on two different media types, with one copy off-site. And test your backups regularly — a backup you can't restore is worthless. Ensure at least one backup copy is immutable and offline, so ransomware can't encrypt it.

2. Patch Everything, Every Time

Keep operating systems, applications, and firmware updated. Enable automatic updates where possible. Many ransomware attacks exploit vulnerabilities that had patches available for months. The 2017 WannaCry attack, which cost billions globally, exploited a vulnerability that Microsoft had already patched — unpatched systems were the only ones affected.

3. Train Your Staff

Your employees are your first line of defence. Regular security awareness training reduces the risk of a successful phishing attack by up to 70%. Simulated phishing campaigns are particularly effective — they show you exactly which staff members need additional training.

4. Restrict Administrative Access

Only give admin rights to people who absolutely need them. Most ransomware spreads through admin accounts — limit the blast radius. Implement the principle of least privilege and use separate admin accounts for system administration tasks.

5. Use Endpoint Protection

Modern endpoint detection and response (EDR) tools can catch ransomware before it executes, even if it's a new variant that traditional antivirus wouldn't detect. EDR uses behavioural analysis to identify ransomware-like activity — mass file encryption, unusual process behaviour — and stops it in its tracks.

What to Do If You're Hit

1. **Disconnect immediately** — Pull the network cable or disconnect from Wi-Fi
2. **Don't pay the ransom** — There's no guarantee you'll get your data back
3. **Call your IT provider** — They can help contain and recover
4. **Report it** — Contact the SAPS cybercrime unit

Ransomware FAQ

Q: Should I pay the ransom if my data is encrypted?

A: We strongly advise against it. Studies show that only 65% of businesses that pay actually get their data back, and many who pay are targeted again because they're seen as willing to pay. Instead, focus on having robust, tested backups and a clear incident response plan. If you have both, ransomware is an inconvenience, not a catastrophe.

Q: Will antivirus software protect me from ransomware?

A: Traditional antivirus is not sufficient. Ransomware variants evolve faster than signature-based detection can keep up. You need Endpoint Detection and Response (EDR), which uses behavioural analytics and AI to detect and stop ransomware based on what it does, not what it looks like. Many EDR solutions are now available at SMB-friendly prices through managed IT providers.