There is no single ransomware product. Effective defence combines controls that reduce initial access, limit movement, detect malicious activity, contain affected systems and support recovery.
Reduce initial access
Use secure email practices, web and DNS controls, application policies, user awareness and MFA to reduce phishing, malicious downloads and stolen-credential access.
Protect endpoints and servers
Endpoint prevention and EDR should identify malware, ransomware, exploits and suspicious behaviour. Isolation and response capability help contain an affected device before the incident spreads.
Segment the network
Separate users, servers, backups, management, guests and operational systems. Limit administrative access and unnecessary east-west traffic so one compromised endpoint does not have unrestricted reach.
Protect identities
Apply MFA to remote access, privileged accounts and important applications. Review dormant accounts, service credentials and excessive permissions that can help attackers expand access.
Correlate and respond
WatchGuard Cloud and ThreatSync can provide cross-product visibility and response for compatible network, endpoint, identity and wireless technologies. Correlation is most useful when owners and response procedures are defined in advance.
Prepare recovery
Maintain protected backups, test restoration, document decision authority and practise isolation procedures. Security technology cannot replace a tested business-continuity and incident-response plan.