A 30-Minute Ransomware Self-Audit for Small Business Networks

Small businesses, like the shops and offices around Santa Fe, New Mexico,
often have no dedicated security team. If you're the dev or admin, everyone asks for help, here are five checks that take about 30 minutes in total and
Cover the weak points automated ransomware attacks go after.

Ransomware campaigns mostly don't pick victims by location. Automated
scanners look for exposed services, leaked passwords, and old software, and
Whoever shows up gets hit. So the goal is simple: don't show up.

Only run these checks on systems and networks you own or are authorized
to test.

1. Is anything dangerous exposed to the internet?

From a machine outside your network, scan your own public IP for commonly
abused ports:

nmap -p 22,445,3389 <your-public-ip>

Remote Desktop (3389) and SMB (445) should not be reachable from the open
internet. If they are, put remote access behind a VPN with MFA and close the
ports on the router or firewall.

2. Is Remote Desktop enabled where it shouldn't be?

On a Windows machine (0 means remote connections are allowed):

Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' `
  -Name fDenyTSConnections

3. Has anyone set up a sneaky mail forwarding rule?

Attackers who get into a mailbox often add a forwarding rule to watch
conversations and redirect payments. In Exchange Online PowerShell:

Get-InboxRule -Mailbox user@yourdomain.com |
  Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo }

If you find a rule nobody created, treat it as a possible compromise: reset
the password, revoke sessions, and investigate.

4. How old are your updates?

# Windows: most recent patches
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

# Debian/Ubuntu: pending upgrades
apt list --upgradable

Don't forget routers, firewalls, and NAS devices. They are common entry.
points and often run firmware that's years out of date.

5. Can you actually restore from backup?

This is the check people skip. Pick one file or system and restore it from
your backup into a test location. Then confirm that at least one copy is
offline or immutable, so ransomware can't encrypt or delete it. A backup you
have never restored from is a guess, not a plan.

Quick wins to do next

• Turn on MFA for email, cloud storage, banking, and remote access.
• Use a password manager to end password reuse.
• Limit admin rights to the people who need them
• Write a one-page incident plan: who to call and how to isolate machines.

If you are hit

1. Disconnect affected machines from the network.
2. Don't wipe anything yet. You may need it for forensics.
3. Contact your IT provider or an incident response firm.
4. Report it to the FBI's IC3 at https://www.ic3.gov and notify your insurer.

Wrap-up

Five checks won't make you bulletproof, but they close the doors that most
automated attacks try first. What's the first thing you'd fix on your own?
network? Tell me in the comments.

*Disclosure: I used AI assistance to draft this article. I reviewed it.
checked the facts, and tested the commands myself. *