A ransomware attack rarely begins with a dramatic warning. It can start with an ordinary-looking invoice, a fake Microsoft 365 sign-in page, or a missed software update on one laptop. By the time files are encrypted and a payment demand appears, the real work is no longer prevention – it is recovery. Knowing how to protect devices from ransomware helps households and Australian businesses avoid that costly position.
Ransomware is malicious software that locks or encrypts files, systems or entire networks until a ransom is demanded. Criminals often threaten to publish stolen information as well, putting customer data, financial records and business continuity at risk. A fast internet connection and reliable devices are valuable, but they also need sensible security controls around them.
How to protect devices from ransomware before it starts
The most effective approach is layered protection. No single setting, security product or staff rule will stop every threat. But several practical safeguards working together can make an attack far less likely to succeed and far easier to recover from.
Keep every device and application updated
Software updates are not just about new features. They often fix security flaws that attackers already know how to exploit. Set operating systems, browsers, mobile devices, routers and business applications to update automatically where practical. Include less obvious equipment, such as network-attached storage, point-of-sale devices, smart cameras and remote-access software.
For a household, this may mean checking that laptops and mobiles are receiving updates and replacing an ageing router that no longer receives security patches. For a business, it requires a documented patching process. Critical fixes should be assessed and applied promptly, while larger changes can be tested first to avoid disruption to essential systems.
Back up data properly, then test the restore process
A backup only protects you if it is separate from the affected device and can be restored when needed. If ransomware reaches a shared drive or cloud folder that synchronises automatically, it may encrypt backed-up copies as well.
Use the 3-2-1 principle where possible: keep three copies of important data, on two different types of storage, with one copy kept offline or otherwise isolated. For businesses, immutable backups are particularly useful because they cannot be altered or deleted for a defined retention period.
Testing matters as much as creating the backup. Restore a sample of files regularly and confirm that staff know who can access backups, how long recovery will take and which systems should be restored first. A backup that cannot be located, opened or restored under pressure is not a continuity plan.
Treat unexpected messages with healthy suspicion
Phishing remains one of the most common ransomware entry points. An attacker may impersonate a supplier, delivery company, bank, colleague or government agency. The message can look convincing, particularly if it refers to a real project, invoice or staff member found through public information.
Before opening an attachment, scanning a QR code or signing in through an emailed link, pause and check. Look closely at the sender address, spelling, tone and destination of the link. If a request for payment, password reset or urgent document access seems unusual, verify it using a known phone number or separate contact method.
For business teams, regular awareness training should use realistic examples relevant to their work. Training is not about blaming someone who makes a mistake. It is about creating a culture where people feel comfortable reporting a suspicious email quickly, before it becomes a wider issue.
Use strong sign-ins and multi-factor authentication
A stolen password can give criminals a foothold in email, cloud storage, accounting platforms and remote desktop systems. Long, unique passwords are essential, and a password manager can make them easier to use without writing them down or reusing them.
Multi-factor authentication, or MFA, adds another check beyond a password. It should be enabled on email, cloud platforms, financial systems, administrator accounts and any tool that can access business data remotely. Authenticator apps or security keys are generally safer than SMS codes, although SMS is still better than relying on a password alone.
Businesses should also remove old accounts promptly when staff leave or suppliers finish their work. Shared administrator logins make it difficult to trace activity and should be avoided.
Protect devices from ransomware with sensible access controls
Ransomware spreads faster when every user has access to every folder and device. Limit access to the information people genuinely need for their role. This is known as least-privilege access, and it reduces the damage if one account is compromised.
Separate everyday user accounts from administrator accounts. Staff should not browse the web or check email while logged in with permissions to install software or change network settings. Disable unnecessary remote access, and protect any remote desktop or VPN service with MFA, strong credentials and access restrictions.
For organisations with multiple sites, remote staff or cloud applications, network segmentation can contain an incident. Separating office devices, guest Wi-Fi, servers, phones and operational equipment means one compromised device is less likely to reach everything else. The right design depends on the size and complexity of the business, but even a small office benefits from keeping guest access separate from business systems.
Choose endpoint protection that can detect suspicious behaviour
Traditional antivirus software remains useful, but ransomware protection should go further. Modern endpoint protection can identify suspicious behaviour, such as rapid file encryption, unusual login activity or attempts to disable security tools. It may isolate a compromised device before malware reaches shared systems.
For a home user, built-in device security with reputable protection software may be appropriate. A business handling customer data, financial information or critical operations will usually need centralised monitoring, alerts and device management. The trade-off is cost and administration, but the visibility is valuable when a small IT team is responsible for many devices.
Secure the network equipment too
Your router or firewall is a gatekeeper between devices and the internet. Change default administrator passwords, use current encryption on Wi-Fi, disable features you do not need and keep firmware current. Do not expose device management pages to the public internet unless there is a clear business need and appropriate protection in place.
For businesses, a managed firewall can provide content filtering, intrusion prevention and clearer control over network traffic. It will not replace good user practices or backups, but it adds another useful layer. Reliable connectivity should support continuity, not become an unmonitored path into the network.
What to do if ransomware is suspected
Speed matters, but panic can make an incident worse. If a device shows a ransom note, files suddenly gain unfamiliar extensions, or you see unusual pop-ups and login alerts, disconnect the device from Wi-Fi and unplug its network cable. Do not turn it off immediately unless instructed by your IT or security provider, as useful evidence may be lost.
For a business, report the incident to the designated IT contact straight away. Isolate affected systems, preserve relevant messages and logs, and check whether other accounts or shared drives show signs of encryption. Reset potentially compromised credentials from a clean device, especially email and administrator accounts.
Avoid paying the ransom as a default response. Payment does not guarantee data recovery, attackers may retain stolen information, and it can encourage further extortion. The decision can involve legal, operational and insurance considerations, particularly where sensitive data is involved. Seek qualified incident-response advice and notify relevant parties where required.
Households should contact a trusted IT professional if they are unsure how far the infection has spread. Businesses should have an incident response plan that identifies decision-makers, recovery priorities, key contacts and customer communication steps before an emergency occurs.
Make ransomware protection part of normal operations
The best security habits are routine rather than reactive. Schedule updates, review user access, test backups and talk about suspicious emails often enough that they become part of normal work. For families, that might mean a short check of device settings every few months. For businesses, it may involve managed endpoint protection, firewall oversight and a documented recovery plan.
Ransomware prevention is ultimately about protecting what keeps life and work moving: family photos, payroll, customer trust, project files and the systems people rely on each day. A few consistent controls now can preserve far more than data when something goes wrong.