Ransomware Defence Guide | De4sec Technology

Contents

How Ransomware Actually Works
Prevention: Block Initial Access
Detection: Identify During Dwell Time
Containment: Limit Blast Radius
Recovery: When Prevention Fails
De4sec Ransomware Defence Package

How Ransomware Actually Works

Understanding the ransomware attack lifecycle helps explain why specific controls are effective — and why some defences that feel comprehensive leave significant gaps.

Stage	What happens	Time typically
Initial Access	Phishing email clicked, credential stolen, or unpatched service exploited	Day 0
Persistence	Attacker creates backup access — hidden accounts, remote access tools	Day 0–3
Lateral Movement	Attacker moves from initial foothold to other systems	Day 1–14
Privilege Escalation	Attacker gains admin/domain admin credentials	Day 3–14
Discovery	Attacker maps backup systems, identifies high-value targets	Day 7–21
Exfiltration	Data stolen for double extortion leverage	Day 14–21
Execution	Ransomware deployed — files encrypted, ransom note displayed	Day 21+

The average dwell time before ransomware executes is 21 days. Attackers are patient. Detection during the lateral movement phase prevents the worst outcomes.

Prevention: Block Initial Access

Patch critical vulnerabilities

✓Internet-facing services patched within 48 hours of critical vulnerability disclosure

✓RDP not exposed to the internet — use VPN or Azure Bastion instead

✓Patch applications and OS on a defined cadence — Microsoft Intune for automation

Email security

✓Safe Links and Safe Attachments via Defender for Office 365

✓DMARC at p=reject — eliminate domain spoofing

✓Staff training on phishing identification

Credential security

✓MFA enforced for all users — especially email and remote access

✓Entra ID Identity Protection — block risky sign-ins automatically

✓Password protection — disable common passwords

Detection: Identify During Dwell Time

If initial access is not prevented, early detection during the attacker's dwell period stops ransomware before execution.

✓Microsoft Sentinel SIEM — alert on impossible travel, new admin accounts, bulk file access

✓Microsoft Defender for Endpoint — behavioural detection of attacker tools (Cobalt Strike, Mimikatz, living-off-the-land techniques)

✓Audit logging for admin actions — changes to user accounts, group memberships, security policies

✓Backup access monitoring — alert if backup systems are accessed from unusual accounts or at unusual times

Many ransomware attacks are detected during the dwell phase through MFA prompts the legitimate user doesn't recognise. This is why prompt anomaly alerts matter — users need a clear way to report suspicious MFA requests.

Containment: Limit Blast Radius

Network segmentation limits how far ransomware can spread if it executes. A flat network where every device can reach every other device allows ransomware to encrypt everything. A segmented network limits damage to one segment.

✓VLANs or subnets separating finance, operations, IT, and guest networks

✓Firewall rules blocking east-west traffic that has no business justification

✓POS and payment systems on isolated network segment

✓Backup systems not accessible from primary workstation network

✓Admin access restricted to dedicated admin jump hosts — not from daily-use laptops

Privileged Access Workstations (PAW)

Admin tasks should only be performed from a dedicated, hardened device with no internet access. This prevents admin credentials from being captured on a compromised workstation.

Recovery: When Prevention Fails

Prevention and detection reduce the probability of a ransomware event. They don't eliminate it. Recovery capability determines survival.

✓Tested backup — most recent clean backup confirmed restorable within the past 90 days

✓Backup isolation — backups cannot be reached from the primary network during an attack

✓Recovery time objective — documented and tested: how long does a full restore actually take?

✓Incident response plan — who to call, what to disconnect, what not to delete

✓Cyber insurance — confirm coverage and incident response support included

Businesses that recover well from ransomware are not the ones who got lucky — they're the ones who built recovery capability before they needed it.

De4sec Ransomware Defence Package

Prevention

Essential Eight implementation, MFA enforcement, patch management, email security configuration.

Detection

Microsoft Sentinel deployment, Defender for Endpoint, 24/5 alert monitoring.

Containment

Network segmentation review, privilege access review, admin hardening.

Recovery

Backup design, testing, RTO/RPO definition, incident response plan documentation.

Contact support@de4sec.technology or book a free discovery call at de4sec.technology

// NEXT STEP

Ready to implement this?

De4sec provides hands-on implementation. Book a free discovery call — we assess your environment at no cost.

Book a Free Discovery Call →de4sec.technology

© 2026 DE4SEC TECHNOLOGY.