By The Structured Networking Team —
Ransomware attacks are all too common. Bad actors, which include nation-state adversaries, criminal syndicates, and even nefarious individuals, are targeting all levels of government — as well as publicly traded and private businesses of all sizes.
Combating these threats is an uphill challenge. But, as a network engineer, you play a pivotal role in fortifying this country’s network infrastructure against ransomware risk. As a kickoff to our ransomware prevention series for 2025, here are six best practices for network engineering teams to implement.
Segment the Network
Network segmentation isolates critical systems from less secure areas, preventing ransomware from spreading freely. Segmentation isn’t just a way to add security, it also provides increased manageability and performance gains.
Segmentation is commonly grouped by administrative or technical requirements. Administrative segmentation occurs when users of similar job roles require access to resources. Technical segmentation is commonly used when devices share a similar purpose on the network.
Historically, it is common for small businesses to omit segmentation from their network design, but we at Structured believe this is a critical oversight – and one that can and should be remedied. Structured recommends segregating the network into different categories, some of which are listed below:
- Network Management
- Wired Users
- Phones
- Physical Security (cameras and door access controls)
- IoT
- Servers
- Corporate Wi-Fi
- Guest Wi-Fi
Bonus Tip: Implement microsegmentation for added granularity.
Unlike traditional network segmentation, microsegmentation is meant to be dynamic and adaptive to changing network conditions, application deployments, and user activities. With microsegmentation, policies are highly targeted for individual workloads, application-level control, and even specific processes. Security policies within microsegmentation are typically enforced with software, such as a hypervisor, host-based firewall, or a software-defined network (SDN) controller. As an added benefit, this level of granularity and control helps companies meet regulatory requirements by ensuring sensitive data is better protected.
Implement a Zero-Trust Architecture
Adopt a “never trust, always verify” approach to limit unauthorized access and reduce ransomware risk. A key feature of Zero Trust includes enforcing least privilege access for all users and devices.
Modern networks leverage microsegmentation, advanced network access services, and “colorless” ports to secure the network. (Colorless ports are a network switch port or interface that is dynamically configured based on the connected device or network policy. They do not have a pre-assigned VLAN.)
Zero-Trust architecture enables network admins to ensure that every user is provided with the same level of access no matter how they are connecting (wirelessly, physically wired, or remotely). This approach should also be taken when assigning network administrators’ roles (admin, operator, etc.) Ensure that each network admin has the proper number of permissions to accomplish their job functions and nothing more. This reduces the attack surface and contains breaches more effectively.
Bonus Tip: Require multifactor authentication (MFA) for accessing sensitive systems.
Many customers are taking advantage of cloud-based management and monitoring of network infrastructure. These cloud-based solutions should be configured to use MFA.
Keep Network Hardware Patched
Unpatched vulnerabilities are a common entry point for ransomware. Regularly update firmware for firewalls, routers, switches, wireless LAN controllers, APs, etc. Pay close attention to vendor-reported vulnerabilities. It is very easy to neglect firmware upgrades as it requires downtime, or the network engineer is bogged down with other tasks, but don’t let these inconveniences compromise security.
Bonus Tip: Consider outsourcing patching to a reputable managed IT services provider.
Patching should be done at least weekly, and ALWAYS after a vulnerability has been discovered. To minimize downtime, patching typically is done at night, which can present a hardship for IT teams that do not have 24x7x365 staffing. Most managed IT services providers offer 24x7x365 service, which can help time-strapped teams keep their systems fully up to date.
Monitor the Network with SIEM and NDR Tools
Proactively detect anomalies using Security Information and Event Management (SIEM) and Network Detection and Response (NDR) tools. These tools provide real-time insights and flag suspicious behaviors, such as unusual data transfers or encryption activity. These tools are used to normalize the logging information from various network appliances and correlate events with a time stamp.
Configure Network Time Protocol (NTP)
When reviewing logs, it is important that the network appliances provide accurate time stamps. Verify that all your network appliances are syncing their clocks with the same NTP server for consistency.
Enforce Backup Strategies
Regular, secure backups are critical for recovering from a ransomware attack. Typically, this applies to data storage, but it is equally important that configuration files of the network infrastructure are also backed up securely for disaster recovery purposes. Ensure backups are immutable and disconnected from the main network.
Bonus Tip: Test, test, test and carefully document your disaster recovery protocols.
Testing and documentation helps ensure you can quickly restore critical systems and data from your backups – all without reintroducing the ransomware that caused the downtime event in the first place. All too often, companies experience excessive downtime and data loss because they did not adequately document recovery procedures or test backups for recoverability. Put your plans and your backups through their paces with downtime simulations and tabletop exercises. It is so much easier to remediate problems when there is not an actual emergency.
Final Thoughts on Reducing Ransomware Risk
Implementing these network engineering best practices can significantly reduce your organization’s vulnerability to ransomware attacks. By adopting a proactive and layered security approach, you’ll protect your network, users and data; build resilience against emerging threats; more easily meet regulatory compliance mandates; and provide more visibility, manageability, control and sanity to your entire networking team.
Do you need assistance with applying best practices to your network in order to reduce ransomware risk? If so, contact your Structured account manager or email info@structured.com today! We offer professional and managed IT services to help secure networks of all sizes. We even can help with disaster recovery planning and tabletop exercises.