80 workstations,
zero scares.

With two-factor authentication on email and remote access, and by checking that backups genuinely restore. Those are the two measures that remove the most risk per euro spent, and neither requires new hardware or infrastructure work: they're configuration on top of what's already there. Two-factor closes the most common way in, which isn't someone breaking through a firewall but a reused password that turned up in a leak from some other service unrelated to the firm. Tested backups close the way out: if something fails anyway, there's a real way to get the data back in hours rather than days. After those two, the next best ratio of cost to risk avoided is usually a hardware inventory and regular patching. The more expensive architectural changes, such as network segmentation or virtual desktops, can wait for a second phase.

They work very well for office and administrative roles, which in a consultancy are usually most of the team: accounts, analysis, client services, any job that lives mainly in spreadsheets, email and business applications. There the advantage is clear, because the data never leaves the controlled environment (all that travels to the home computer is the image of the screen) and a lost or stolen laptop doesn't mean lost information, because none was stored on it. Where it needs more thought is graphic design, video editing or any calculation that demands a lot of graphics power: there a local machine still has the edge, because a virtual desktop sized properly for that work gets expensive. The usual answer in consultancies with mixed roles is not to force a single model: virtual desktops where they pay off, managed physical machines where they don't.

It isn't a general legal requirement, although various sector-specific and data protection rules are pushing ever harder in that direction. What really matters isn't the formal obligation but what it prevents in practice: a credential leaked by a third party unconnected to the firm (something the firm has no control over) stops working as a way in if a second factor is needed that only the employee has, usually their mobile. In a firm handling client data with sensitive financial or personal information, treating two-factor as optional is hard to justify on the day something goes wrong. It isn't expensive or complicated to roll out: most email and remote access services already include it; you just have to switch it on and explain it properly to the team. We explain how this fits into a broader maintenance contract in what a maintenance contract should include.

It depends which part of the change you look at. Two-factor and regular patching make a difference quickly, within weeks, because they stop at the root the steady trickle of small incidents that used to eat up hours every week: compromised passwords, out-of-date machines failing, viruses getting in through a known, unpatched vulnerability. It's the kind of improvement you see in the number of tickets before it shows up in any report. Architectural changes, such as segmenting the internal network or rolling out virtual desktops, are different: they're introduced in phases, workstation by workstation or department by department, and their effect builds up over the whole project rather than all at once. Don't judge the whole project by how slow it seems at first, while the new and the old still run side by side until the migration is complete.

The benchmark is still the 3-2-1 rule: at least three copies of anything you can't afford to lose, on two different media, with one of them off site. In a consultancy with client data, you need to add two specific things. The first is encryption: a backup containing financial or personal information that leaves the office (on an external drive or with a cloud provider) must travel and be stored encrypted, because otherwise losing that media is as serious as losing the data on the original computer. The second is a restore test: a backup that nobody has checked can be recovered isn't a backup, it's an assumption. If you're torn between setting up your own NAS or paying for cloud backup, NAS or cloud for backups explains it according to where your real point of failure lies.

No measure brings the risk down to zero, so it's worth being clear about what to do in the first few hours before you need to. First, isolate the affected machine or machines from the network immediately, by unplugging the cable or turning off the Wi-Fi, to stop the encryption spreading to shared folders or other workstations connected to the same resources. Second, don't pay the ransom: there's no guarantee of getting anything back in return, and paying doesn't fix the way in that made the attack possible. With the tested backups from the previous question, the way out is usually to restore from the last clean backup once you've confirmed the source of the attack has been identified and closed. That's exactly why tested backups and two-factor are the two measures that decide whether an incident like this ends up as an afternoon's scare or several days at a standstill. The details are in ransomware: the first few hours.