Who is this guide for?
This document is intended to help business owners, IT managers, system administrators, IT teams and enterprise technology purchasing teams evaluate ransomware risk from both technical and operational perspectives.
The objective is not to sell a single product, but to explain how security controls should be evaluated together.
Contents
1. What Is Ransomware?
Ransomware is a general term for malicious attacks intended to make systems or data unusable or inaccessible. In some incidents, attackers may encrypt files, exfiltrate data and then demand a ransom.
Enterprise defense should not be treated simply as “installing antivirus.” Identity security, network security, endpoint security, backup, monitoring and incident response should be evaluated together.
2. How Can Ransomware Attackers Enter an Organization?
Internet-exposed vulnerabilities
Unpatched or misconfigured internet-facing services can increase the attack surface.
Compromised credentials
Stolen usernames and passwords can create significant risk, especially for remote access without MFA.
Phishing / oltalama
Fraudulent emails, links or files can be an initial access vector.
Previously compromised endpoints
Malicious activity on one endpoint may later spread to other systems.
Insecure remote access
Unnecessarily exposing RDP, VPN or management interfaces to the internet can create risk.
Misconfiguration
Excessive privileges, weak segmentation and unnecessary services can increase the impact of an attack.
3. 10 Essential Controls to Reduce Ransomware Risk
- Have critical servers, endpoints, network devices and cloud assets been inventoried?
- Have critical data and business-essential systems been identified?
- Are backups protected so they cannot be easily deleted or encrypted by an attacker?
- Are real restore tests from backups performed regularly?
- Is MFA enforced for VPN, email and privileged accounts?
- Have unnecessary internet-facing services been disabled or restricted?
- Is centralized security and incident visibility available across endpoints?
- Are firewall rules and remote-access policies reviewed periodically?
- Are user and administrator privileges aligned with the principle of least privilege?
- Is there a documented and tested incident-response / recovery plan?
4. Ransomware-Resilient Backup
Backup is a critical recovery layer for business continuity after an attack. However, simply creating backups is not enough.
Controls to evaluate
- Multiple backup copies across different media or systems.
- Offline, isolated or immutable copies where practical.
- Separate and strongly protected backup administration accounts.
- Backup encryption and restricted access permissions.
- Regular restore testing.
- Predefining the recovery order for critical systems.
Doz Teknoloji: Data backup solutions
5. How Does a Firewall Fit into Ransomware Defense?
A firewall is an important security layer for controlling network traffic, enforcing access policies, operating VPN services and applying certain threat-prevention mechanisms.
A firewall alone cannot guarantee prevention of malicious files reaching endpoints, compromised accounts or every malicious action originating from inside the environment.
Layered security approach
| Katman | Primary objective |
|---|---|
| Firewall / NGFW | Network traffic, access policies, VPN and security controls |
| Endpoint Security / EDR | Endpoint behavior monitoring and response |
| MFA | Reduce the risk of compromised password abuse |
| Backup | Post-attack data recovery capability |
| Segmentasyon | Limit the spread of an attack |
| Logging / Monitoring | Visibility, analysis and incident investigation |
Doz Teknoloji: Firewall and antivirus solutions
6. The Difference Between Antivirus, EDR and XDR
| Teknoloji | Rol | Assessment |
|---|---|---|
| Antivirus / Endpoint Security | Malware detection and prevention | Core endpoint security layer |
| EDR | Endpoint behavior monitoring, investigation and response | Can improve incident visibility and investigation capability |
| XDR | Correlation of signals from multiple security sources | Should be evaluated according to the organization’s product ecosystem |
Product selection should consider more than a brand name or the term “AI”; centralized management, alert quality, incident investigation, integrations, licensing model and the organization’s operational capacity should all be evaluated.
7. MFA and Identity Security
Compromised passwords can make it easier for attackers to access enterprise systems. MFA is an important control that reduces the risk of password-only access.
- VPN and remote access
- Enterprise email
- Administrator accounts
- Cloud management consoles
- Backup administration accounts
Phishing-resistant MFA options should also be considered where practical.
8. Least Privilege and Administrator Accounts
Restricting each user or service account to only the resources it needs can help limit the spread of an attack.
- Do not use privileged administrator accounts for routine daily activity.
- Limit the number of highly privileged accounts such as Domain Administrator accounts.
- Disable unnecessary interactive access for service accounts.
- Ensure MSP and third-party access is time-bound, logged and controlled.
9. Network Segmentation and Limiting Lateral Spread
When ransomware reaches an endpoint, functional network segmentation can be considered to make lateral spread to other systems more difficult.
Server network
Protect critical servers with security policies separate from the user network.
Management network
Restrict access to network devices and management interfaces.
Backup network
Separate the backup infrastructure from routine user access.
Misafir / IoT
Separate untrusted devices from critical resources.
10. Ransomware Risk in Cloud and Virtualized Environments
Ransomware risk is not limited to physical servers. Virtualization management layers, cloud accounts, SaaS applications and cloud storage should also be part of the security and recovery plan.
- MFA and privilege management for cloud administration accounts.
- Monitor logging and administrative activity.
- Use backup for cloud data with independent or separately controlled access.
- Evaluate deletion protection, versioning and immutability capabilities.
- Keep hypervisors and management platforms up to date.
11. 🚨 First Steps When a Ransomware Attack Is Suspected
- Limit spread: consider isolating devices believed to be affected from the network.
- Preserve evidence: retain logs, alert records, the incident timeline and current system state.
- Do not delete or alter data indiscriminately: avoid uncontrolled changes to backups, logs or suspicious systems.
- Review access: investigate suspicious VPN, administrator and cloud sessions.
- Determine scope: investigate which users, endpoints, servers, network segments or cloud accounts are affected.
- Follow the recovery plan: use the predefined priority order for critical business systems.
Important: immediately rebuilding systems or making uncontrolled changes to encrypted data can make it harder to understand the source of the incident. A controlled incident-response process should be preferred.
12. How Should a Recovery Plan Be Prepared?
Define a priority order
- Identity services and core infrastructure
- Critical network services
- Databases and critical applications
- Dosya servisleri
- User endpoints
Define RTO and RPO targets
RTO defines how quickly a service should be restored; RPO defines the acceptable data-loss window.
Perform restore testing
“We take backups” and “we can actually restore from backup” are not the same thing. Critical systems should be tested through regular restores.
13. Legal and Organizational Considerations
A ransomware incident is not merely a technical failure. Depending on the nature of the incident, it may have implications for personal data, contracts, insurance, business continuity, employee data, customer data and notification obligations.
Document during the incident
- Date and time the incident was first detected
- Systems initially affected
- Isolation and access-control measures taken
- Log and alert records
- Backup status
- Notifications made to internal and external stakeholders
14. Ransomware Resilience Assessment with Doz Teknoloji
Doz Teknoloji can help organizations technically assess their existing IT infrastructure from security and business-continuity perspectives. The assessment considers multiple layers together rather than relying on a single product.
Servers and virtualization
Resilience and recovery planning for critical infrastructure.
Server solutions →35+ years · 2000+ completed projects · 150+ satisfied customers
Architecture and operating model
Ransomware resilience combines reducing initial access, limiting spread, protecting administration and establishing clean recovery. Restoring encrypted files differs from removing compromised identities and persistence. Returning data to an earlier point alone does not prevent reinfection. Isolate the recovery environment from production.
- 1Initial-access controls
- 2Spread boundaries
- 3Isolated clean recovery
- 4Business validation
Design parameters
- Lateral movement boundary
- Constrain administrator identities, SMB/RDP and management networks; measure one compromised account’s reach.
- Clean recovery path
- Separate isolated backups, keys and clean management from production identities; test restoration.
- Identity and scope
- Separate user, device and service identities. List protected resources and access paths outside policy enforcement.
- Policy decision
- Document allow, deny and exception conditions. Rule order, default behavior and session renewal can change outcomes.
- Capacity and latency
- Measure actual peak workload. Compare latency and queues with controls enabled against an equivalent baseline.
- Logging and response
- Identify where decision records are stored. Event identifiers, time, source and policy reason should enable investigation.
Worked example
In a drill, assume production identities are unavailable and the main repository is lost. Use separate recovery access, a verified copy, a clean target and controlled reconnection. Before business approval, test DNS, identity, applications and required workflows. Real malware is unnecessary.
Troubleshooting
| Observation | Likely cause / distinction | Verification |
|---|---|---|
| Backups survive but recovery access is lost | Identity, keys or licenses may remain in the same compromised domain. | Test recovery access on a separate target while the primary directory is unavailable. |
| Expected legitimate operation is blocked | Rule scope or exceptions may match incorrectly; disabling the entire control hides the cause. | Inspect decision logs for one test identity and resource, and reproduce the condition in a pilot. |
| Access persists after policy changes | Existing sessions, tokens or alternate access paths may have different enforcement timing. | Test new and existing sessions separately; verify that direct access cannot bypass enforcement. |
| Alert exists but cannot be investigated | Missing fields, clock differences or collection gaps can prevent correlation. | Match source and central records, and demonstrate end-to-end traceability. |
Acceptance checks
- Demonstrate recovery to a clean target without depending on production accounts.
- Test authorized and denied flows separately using the same controlled identity.
- Exercise new sessions, expired sessions and revoked permissions.
- Record owner, scope and expiry for exceptions.
- Exercise narrowly scoped rollback during a false-positive scenario.
- Document behavior during logging loss and policy-service unavailability.
Related concepts
Trust boundary and failure domain
A trust boundary separates components governed by different access decisions; a failure domain groups resources that one event can affect together. Two VLANs do not create a strong trust boundary when routing between them is unrestricted. Backups in different folders still share a failure domain if one administrator can delete both. Assess physical location, identity provider, management account, network path and power source separately. Test which access paths and recovery options remain available when a component is lost.
Least privilege and separation of duties
Least privilege limits the permissions needed for a task to specific resources and time periods. Giving everyone the same administrator role complicates access reviews and investigations. Separate daily-use identities from privileged accounts, and restrict interactive use and unnecessary network access for service identities. An access matrix should show which operation an identity may perform on each resource. Test whether an application keeps working after a permission is removed: unnecessary privileges sometimes become visible only during controlled reduction.
Immutability and deletion authority
Immutable retention restricts modification or deletion for a defined period. An application promise, storage-enforced protection and physical isolation are different controls. Review lock duration, clock handling, administrative privileges and deletion paths together. Whether data is automatically deleted after expiry depends on the product policy. On a controlled test copy, attempt deletion using ordinary and privileged accounts, then verify recovery from the protected copy. Protection against deletion does not replace a readability or restore test.
RPO and the actual loss window
RPO is the acceptable duration of data loss after an incident. A backup schedule alone does not prove it: failed jobs or delayed replication to another site can enlarge the window. Compare the incident time with the latest usable, consistent recovery point. If an incident occurs at 14:00 and the verified copy is from 13:20, the observed loss window is 40 minutes. Set targets per application; a file archive and a database receiving continuous orders may have different requirements.
RTO and end-to-end recovery time
RTO specifies how soon a service must become usable after an incident. Downloading a backup or booting a VM accounts for only part of that duration. Record detection, approval, infrastructure preparation, data transfer, application startup and business validation separately. Define exactly what starts and stops the test clock. The same technical restore duration can produce different business interruptions when dependencies or access approvals introduce additional waiting.
Dependencies and restart order
Services commonly depend on identity, DNS, time, networking, databases and licensing. Record a dependency graph describing conditions for operation, rather than only a list of equipment. Recovery order follows that graph; circular dependencies may require emergency access paths. Distinguish restored infrastructure from resumed business activity. Assign an owner, validation method and alternative access path to each dependency. Test assumptions by deliberately making one component unavailable in a controlled end-to-end exercise.
Primary documentation
15. Frequently Asked Questions
What is ransomware?
Ransomware is a general term for malicious attacks used to make systems or data inaccessible.
How can an organization protect against ransomware?
MFA, patch and vulnerability management, reducing internet-exposed services, endpoint security, firewalls, network segmentation, least privilege and tested backup should be evaluated together.
Is backup alone sufficient against ransomware?
No single control guarantees complete protection. Protecting backups from attacker modification or deletion, enforcing access control and performing restore tests are important.
Can a firewall stop ransomware on its own?
No. A firewall is an important network-security layer, but it should be combined with endpoint security, identity controls, backup, segmentation and incident response.
What should be done first when ransomware is suspected?
Consider isolating affected systems, preserving logs and evidence, and initiating a controlled incident-response process.
What does EDR provide against ransomware?
EDR can help centrally monitor and investigate endpoint behavior and, where appropriate, support response actions.
Does MFA reduce ransomware risk?
MFA can make many attacks that rely solely on compromised passwords significantly more difficult.
Should systems be rebuilt immediately after ransomware?
Uncontrolled rebuilding can destroy evidence. Scope should be established first, followed by a controlled recovery process.
How should firewall cost be evaluated?
In addition to appliance price, performance, licensing, VPN, IPS/IDS, web security, management and support requirements should be evaluated together.
Is Law No. 5651 logging the same as ransomware protection?
No. Logging and ransomware defense address different needs. Logs can support incident investigation, but logging alone is not ransomware protection.
How This Guide Was Prepared
Doz Teknoloji Technical Team
This guide is based on evaluation criteria used by Doz Teknoloji's technical team in enterprise IT projects.
About Doz TeknolojiTechnical Criteria + Primary Sources
Network segmentation, MFA, backups, remote access and incident-response recommendations were cross-checked against CISA StopRansomware guidance.
Improve Decision Quality
To evaluate ransomware prevention and recovery as layered controls rather than as a single-product problem.
Content and primary sources were reviewed again.
Sources and methodology
This guide references CISA #StopRansomware resources and its approach to ransomware readiness, protection, response and recovery. CISA content has not been copied; the guide is an original resource structured from Doz Teknoloji’s enterprise IT and technical-assessment perspective.
Last updated: August 24, 2026 · Technical content is provided for informational purposes.Related Enterprise Solutions
Explore the related service and solution pages to plan implementation.