{"id":13669,"date":"2024-03-12T15:16:36","date_gmt":"2024-03-12T22:16:36","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=13669"},"modified":"2025-10-17T11:16:40","modified_gmt":"2025-10-17T18:16:40","slug":"lessons-learned-at-microsoft-five-steps-you-can-take-to-reduce-your-ransomware-risk","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/lessons-learned-at-microsoft-five-steps-you-can-take-to-reduce-your-ransomware-risk\/","title":{"rendered":"Lessons learned at Microsoft: Five steps you can take to reduce your ransomware risk"},"content":{"rendered":"

\"MicrosoftAs a part of our journey to reduce our ransomware risk internally here at Microsoft, we\u2019ve identified five principles that we believe every enterprise should follow to make themselves more secure from these attacks. We call these our Foundational Five of Ransomware.<\/p>\n

While we use Microsoft products to secure our systems, infrastructure, data, and identities, the Foundational Five are product agnostic and can be scaled to meet the needs and requirements of organizations of any size. This is especially important for smaller organizations, with 70 percent of encounters with human-operated ransomware happening in organizations with fewer than 500 employees, according to the Microsoft Digital Defense Report 2023<\/a>.<\/p>\n

 <\/p>\n

\"The
We\u2019ve learned that adhering to these five principles is the key to fighting ransomware.<\/figcaption><\/figure>\n

Our Foundational Five are:<\/h3>\n
    \n
  1. Move to modern authentication with phishing-resistant multi-factor authentication.<\/li>\n
  2. Always use automatic cloud backup and file syncing.<\/li>\n
  3. Work towards having threat- and risk-free environments.<\/li>\n
  4. Upgrade your posture management to improve the health of your devices, services, and assets.<\/li>\n
  5. Apply least privileged access standards to your full technology stack.<\/li>\n<\/ol>\n

    \"1.\" Modern authentication with phishing-resistant multi-factor authentication<\/h2>\n

    It\u2019s a well-known fact that today\u2019s threat actors don\u2019t break in, they sign in. Whether done through illicitly acquired credentials, brute force attacks, or phishing, inadequate protective measures for authentication are like leaving the front door wide open for attackers to walk through.<\/p>\n

    Microsoft Incident Response observed that 21 percent of customers who experienced ransomware didn\u2019t have MFA or didn\u2019t mandate MFA for privileged accounts, while 37 percent didn\u2019t have advanced MFA protection mechanisms enabled.<\/p>\n

    \u20142023 Microsoft Digital Defense Report<\/p>\n<\/blockquote>\n

    The growth in password-based identity attacks on Microsoft Entra is startling, with a 10-fold increase observed between 2022 and 2023. While the use of multi-factor authentication (MFA) adds an extra layer of security, threat actors are increasingly turning to techniques such as MFA bombing to catch unwitting users off guard. Earlier in 2023, we observed 6,000 MFA fatigue attempts per day on customer identities. This is why we strongly advise using phishing-resistant MFA.<\/p>\n

    Phishing-resistant MFA differs from traditional MFA by binding the token to the legitimate user\u2019s device. Windows Hello for Business and FIDO2 services, like physical tokens and Passkey, are examples of technologies that can be used for added protection. When combined with conditional access policies and step-up authentication, this can be an effective method to protect users who have access to sensitive resources or high-risk roles.<\/p>\n

    Microsoft Incident Response observed that 21 percent of customers who experienced ransomware didn\u2019t have MFA or didn\u2019t mandate MFA for privileged accounts, while 37 percent didn\u2019t have advanced MFA protection mechanisms enabled.<\/p>\n

    Phishing-resistant MFA with conditional access can help prevent:<\/p>\n