Ransomware is now one of the most damaging cyber threats facing organisations in East Africa. Banks, microfinance institutions, government offices, NGOs and growing businesses in Tanzania, South Sudan and Rwanda are all targets. Attackers do not need to choose you specifically. They scan for weak passwords, unpatched servers and careless clicks, then lock your files and demand payment to release them. Often they also steal data first and threaten to publish it.
The good news is that most ransomware attacks succeed because of a small number of common gaps. This checklist explains what to put in place before an attack, so that if one happens, you can recover quickly without paying.
Why East African organisations are exposed
- Remote access left open. Remote desktop and VPN connections set up quickly for staff or suppliers are often protected by a password only.
- Backups that are not really safe. Many offices back up to a USB drive or a shared folder that stays connected to the network. Ransomware encrypts these too.
- Old systems and unlicensed software. Servers and PCs that no longer receive security updates are easy entry points.
- Phishing emails. A single fake invoice or delivery notice opened by one staff member can be enough to start an attack.
- No written plan. When an attack happens, many teams lose valuable hours deciding who to call and what to switch off.
Prevent: close the most common entry points
1. Switch on multi-factor authentication everywhere
Stolen or guessed passwords are one of the easiest ways in. Multi-factor authentication (MFA) on email, VPN, remote access and admin accounts means a password alone is not enough. If you use Microsoft 365, MFA is already included and can be enabled for every user.
2. Remove direct remote desktop access from the internet
Remote desktop should never be open directly to the internet. Put remote access behind a secure VPN on a next-generation firewall, protect it with MFA, and give access only to the people and systems that need it.
3. Patch servers, PCs and network devices
Keep operating systems, applications, firewalls and routers up to date. Replace systems that no longer receive security updates. Use properly licensed software, because unlicensed copies often cannot be updated and sometimes contain malware.
4. Filter email and train staff
Use email security that blocks malicious attachments and links before they reach the inbox. Then train staff, including branch and field staff, to recognise fake emails and report them quickly. Short, regular sessions work better than one long course each year.
Detect and contain: limit the damage
5. Protect every endpoint
Basic antivirus is no longer enough. Modern endpoint protection watches for ransomware behaviour, such as many files being encrypted at once, and can stop the process and isolate the device automatically.
6. Segment the network
Separate servers, staff PCs, CCTV, printers and guest Wi-Fi into different network zones, with firewall rules between them. If one laptop is infected, ransomware cannot spread freely to your file servers and core systems. Firewalls from Fortinet and Sangfor make this practical, even across several offices.
7. Limit admin rights
Most staff do not need administrator rights on their PCs. Keep admin accounts separate from everyday accounts, protect them with MFA, and review who has them regularly. Attackers who cannot get admin rights find it much harder to spread.
8. Monitor and log activity in one place
Central logging and alerts help your team spot unusual activity early, such as logins at strange hours or large amounts of data leaving the network. Logs also show what happened after an incident, which auditors and regulators may ask for.
Recover: make sure you never have to pay
9. Follow the 3-2-1 backup rule
Keep at least three copies of important data, on two different types of storage, with one copy offline or off-site. At least one copy should be immutable, meaning it cannot be changed or deleted, even by an administrator account. Cloud backup with immutable storage is a practical option for organisations without a second data centre.
10. Test your restores
A backup you have never restored is only a hope. Test restoring files and full systems regularly, and measure how long it takes. This tells you whether you could really be back in business in hours, or whether it would take weeks.
11. Write a simple incident response plan
Your plan does not need to be long. It should say who decides, who to call (IT partner, management, insurer if you have one), how to isolate infected devices, how to communicate with staff and customers, and where the offline backups and contact lists are kept. Print a copy, because you may not be able to open files during an attack.
Regulation and data protection
Tanzania, Rwanda and other countries in the region have data protection laws, and financial regulators expect banks and other institutions to manage ICT and cyber risk. A ransomware attack that exposes customer or beneficiary data can therefore have legal and reputational consequences, not only operational ones. Good preparation, central logging and tested backups give you clear evidence that risks are being managed.
Ransomware readiness checklist
- Is MFA switched on for email, VPN, remote access and admin accounts?
- Is remote desktop closed to the internet and accessed only through a secure VPN?
- Are all servers, PCs and network devices supported and up to date?
- Do all endpoints have modern protection that can stop ransomware behaviour?
- Are servers, staff PCs and guest Wi-Fi on separate network zones?
- Do you have at least one offline or immutable backup copy?
- Have you tested a full restore in the last six months?
- Do you have a written, printed incident response plan?
- Have staff received phishing awareness training in the last 12 months?
If you answered “no” or “not sure” to any of these questions, now is the right time to act, before an attack forces the decision.
How Junubia Host can help
Junubia Host works with banks, microfinance institutions, government offices, NGOs and businesses across South Sudan, Tanzania and Rwanda to prevent, detect and recover from ransomware. We supply, install and support Fortinet and Sangfor firewalls and endpoint protection, set up Microsoft 365 with MFA and email security, and design backup and recovery that you can test and trust. See our full range of IT services, or learn more about our IT solutions in Tanzania.
Start with a free IT assessment. Our engineers will review your systems against this checklist and give you a short, clear report on what to fix first. There is no cost and no obligation. Request your free assessment or message us on WhatsApp: +255 768 404 666 (Tanzania and Rwanda) or +211 924 786 666 (South Sudan).
Written by Dut Majak, CEO and Founder of Junubia Host Co Ltd. Dut leads Junubia’s work with banks, government institutions, NGOs and businesses across South Sudan, Tanzania and Rwanda.
