Make a separate backup of important files, turn on automatic updates, and protect important accounts with multifactor authentication. Together, these steps reduce the chance of a ransomware incident and make recovery more practical if one occurs.
Ransomware can lock or encrypt files and demand payment; an attacker may also steal data. Defending against ransomware therefore means both reducing entry points and preparing a clean way to restore information. The right plan includes a test of the backup, not merely a copy that has never been opened.
How to protect against ransomware with backups
Choose files that would be difficult or impossible to replace: family photographs, financial records, project files, and other important documents. Decide how much recent work can be lost. A daily backup may be appropriate for files that change daily; a monthly copy could leave weeks of work missing after an incident.
Keep at least one copy separated from the computer and network when it is not being updated. An external drive can be connected for a backup and then disconnected. A backup service may offer version history or other protections, but check its retention and recovery settings. Ordinary synchronization alone may copy damaged or encrypted files to the cloud as well. CISA’s ransomware guide recommends offline, encrypted backups and regular recovery tests.
Protect the backup itself. Encrypt a portable drive where practical, store it securely, and keep its recovery key somewhere accessible outside the potentially affected device. For cloud copies, use a unique password and multifactor authentication to protect the backup against ransomware-related account compromise. A backup that an attacker can access and erase may disappear along with the original files.
Test that files can be restored
Learning how to protect against ransomware includes checking recovery before an emergency. Select a few representative files, such as a photo, a document, and a spreadsheet, and restore copies to a separate test folder or trusted device. Open each one and confirm that its contents are readable and reasonably current. Do not overwrite the original files during the test.
Record the date of the test, the backup location, and the steps needed to recover. Check whether older versions can be retrieved if the newest copy is damaged. For a larger collection, test a representative folder as well as individual files; the process should work at the scale needed. A small business should also test whether essential applications and systems can be rebuilt, not just whether one document opens.
If a restoration fails, correct the backup settings and repeat the test. Missing folders, an expired subscription, a forgotten encryption key, or a full drive can turn a scheduled backup into an unusable one. A periodic calendar reminder makes this check part of ordinary maintenance.
Close common entry points
A person deciding how to avoid ransomware should begin with updates. Install security updates for the operating system, browser, applications, and device firmware; enable automatic updates where available. Updates repair known weaknesses that attackers may exploit and reduce the risk of a ransomware infection. Replace software that no longer receives security fixes when a supported option is available.
To reduce exposure to ransomware, treat unexpected attachments, links, and requests to install software with care. A message that appears to come from a colleague or delivery service can be forged. Verify an urgent request through a known phone number or a separately opened account rather than using the contact details in the message. Download programs from trusted official sources, and leave built-in security protections enabled.
A plan for how to protect from ransomware should limit what a compromised account can change. Use a standard account for everyday work and administrator privileges only when needed. Remove unused accounts and remote-access services. For an organization, restrict and monitor remote access, keep its software patched, and use a documented process for granting access rather than exposing a login to everyone.
These measures help prevent ransomware by making common paths harder to use. They do not eliminate every route: a stolen credential or an unpatched device can still provide an opening. That is why the separate backup and recovery plan remain necessary.
Protect accounts and recovery methods
When deciding how to protect yourself from ransomware, secure email, cloud storage, and any account that manages backups. Use a different strong password for each account; a password manager can help store them. Turn on multifactor authentication, preferably a phishing-resistant method such as a security key or passkey when the service supports it.
Review recovery email addresses and phone numbers, and keep recovery codes in a secure place. Someone who controls the recovery method may be able to reset a password. The FTC’s guidance recommends updates and multifactor authentication as part of protecting personal information. For a shared workplace account, assign individual access where possible so that access can be removed without disrupting everyone else.
Recognizing a forged sign-in page is also part of defending accounts from ransomware. Enter an address already known to be legitimate or use a saved bookmark, and never provide a one-time code to an unexpected caller. If credentials may have been exposed, change them from a separate trusted device and review recent sign-ins.
Respond before restoring
When considering how to stop ransomware during a suspected incident, first limit its reach. Disconnect the affected device from Wi-Fi, wired networks, and attached backup drives. At work, report the incident to the IT or security team immediately and follow its instructions to contain the suspected ransomware. Preserve the warning and relevant details; avoid reconnecting a backup to a device that may still be infected.
Arrange for the system to be assessed and cleaned or rebuilt before restoring files. The FTC advises updating security software and following removal guidance when malware is suspected. Restore from a known-good copy made before the incident, and consider that stolen data may require account protection or other follow-up even after files are recovered.
Protecting against ransomware is an ongoing routine. To reduce losses from an untested backup, choose one important file now, restore a copy to a separate location, and open it. If the copy is missing or unreadable, fix the backup and test again.
