What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Start with four controls: require multifactor authentication (MFA) on email, remote access, file storage and administrator accounts; patch operating systems and business software; restrict employee and service-provider permissions; and keep encrypted backups that ransomware cannot reach through the normal network. Test restoring those backups. Then write a short incident-response and communications plan so your team knows what to disconnect, whom to call and how to keep working if email is unavailable.
Construction firms often connect office staff, field crews, subcontractors, customers and outside providers through cloud files, payroll, accounting, scheduling and remote access. Protecting those links is more useful than buying a single “ransomware product.” The right controls depend on the systems your company actually uses and the order in which work must be restored.
As an Amazon Associate I earn from qualifying purchases.
What ransomware protection means for a small contractor
Ransomware is an intrusion in which attackers disrupt access to data or systems, commonly by encrypting files and demanding payment. The operational damage can begin before any ransom message appears: project drawings may be unavailable, payroll may miss a run, crews may lose schedules, and customer communication may stop.
Recommended Free Tools
The Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), the FBI and the NSA recommend a layered approach in their #StopRansomware Guide (September 2023). For a small construction business, that means protecting the accounts that unlock other systems, limiting what each account can reach, maintaining recoverable copies outside the production network and preparing people to respond quickly.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
There is no construction-specific attack-rate or loss figure established in the cited guidance. Do not use a general small-business statistic as if it described contractors. Instead, assess the systems whose loss would stop your own jobs or prevent recovery.
Prioritize the controls that stop a single stolen account becoming a company-wide outage
1. Put MFA on every high-impact account
Require MFA for business email, cloud file storage, remote-access tools, virtual private networks, payroll and accounting portals, and administrator accounts wherever the service supports it. A password alone should not unlock privileged or remote access.
CISA’s small-business guidance says, “MFA is a simple way to increase your business’s digital security.” Its MFA guidance recommends phishing-resistant methods where available. Security keys are one option, but verify that your email service, computers, phones and other applications support the key standard before buying hardware. Decide in advance how a worker can recover access if a key is lost, and keep a controlled spare or another approved recovery method.
2. Patch systems and remove unnecessary access
Turn on automatic updates where practical and establish an owner for updates that require scheduling. Cover operating systems, browsers, routers, firewalls, remote-access software, file-sync clients, accounting applications and any server software. Attackers frequently exploit old internet-facing software or stolen credentials; an unpatched system can undermine otherwise strong passwords.
Use least privilege: each employee, subcontractor and service provider should have only the access required for current work. Separate administrator accounts from everyday accounts. Disable former workers’ accounts promptly, remove dormant vendor accounts and review shared logins. Ask whoever manages your technology to list every remote-access path and confirm why each one exists.
3. Keep backups outside the normal attack path
Maintain encrypted backups of critical data and systems in a location ransomware running on an ordinary workstation cannot rewrite or delete. An external drive can provide one offline copy, but it must be disconnected when it is not actively backing up or restoring; CISA warns that a connected drive may be reached by ransomware. Use more than one recovery option where feasible, such as a disconnected local copy plus a separately protected backup service.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Retention matters. Keep multiple versions so an encrypted or silently altered file is not the only copy available. Restrict who can delete backups, protect backup-administration accounts with MFA and log backup failures. Most importantly, perform a real restoration test. A backup that has never produced a usable file or bootable system is an assumption, not a recovery plan.
4. Prepare people and decisions before an emergency
Write down who can authorize shutting down systems, who contacts your IT or incident-response provider, who informs employees and customers, and who coordinates with your insurer, lawyer and authorities. Store the plan somewhere available from a known-safe device and keep a printed or otherwise offline copy. Include phone numbers and alternate channels in case company email is inaccessible.
Map the construction workflows that must be protected
Use an inventory to connect technology to actual work. CISA’s small and medium-sized business resources emphasize knowing your assets and data. List devices, accounts, software, cloud services, network connections, suppliers and third parties, then record what depends on what.
| Business function | Examples to identify | Questions for recovery planning |
|---|---|---|
| Project and field operations | Plans, specifications, photos, change orders, estimating files, mobile devices and shared folders | Which current projects need access first? Can crews work from a read-only export while systems are restored? |
| People and payroll | Payroll provider, timekeeping, tax records, employee contact details | What is the next payroll deadline, and who can run it if the normal portal is unavailable? |
| Accounting and purchasing | Invoices, job costing, banking contacts, purchase orders and vendor records | Which records are required for payments, and how will you verify bank-change requests offline? |
| Scheduling and communication | Calendars, dispatch boards, email, messaging and customer records | What alternate phone tree or messaging channel reaches crews and customers? |
| Remote and third-party access | VPNs, remote desktop, managed-service accounts, subcontractor portals | Who has access now, what can each account reach, and how will access be revoked during containment? |
This is an application of general CISA asset-management and least-privilege advice, not a claim that CISA ranks construction systems or reports a construction-specific ransomware rate. Your inventory should reflect your own contracts, geography, software and legal obligations.
What should a small contractor back up?
Start with data that would either stop work or make recovery impossible:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Active and recently completed project folders, drawings, specifications, photographs, correspondence, contracts and change-order records.
- Estimating, job-costing, accounting, invoicing, tax and banking-support records.
- Payroll, timekeeping, benefits and employee-contact data, subject to applicable privacy and retention rules.
- Schedules, dispatch information, customer and supplier contacts, and approved communication records.
- Configuration and recovery information for servers, network devices, identity systems, line-of-business applications and backup software.
- Device images or installation media and license details needed to rebuild essential computers.
Back up databases in an application-consistent way when the software requires it; copying a database file while it is running may not produce a usable restore. Keep at least one copy encrypted and offline or otherwise isolated from production credentials. Document the location, encryption key custody and restoration procedure without placing the only copy of those instructions on the systems being protected.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Compare backup approaches by recoverability, not by storage size
| Approach | Strength | Failure mode to control | Questions to ask |
|---|---|---|---|
| Disconnected external drive | Simple, inexpensive offline layer for selected files | It is exposed while connected; one drive can fail, be lost or contain only an old copy | Who connects it, how is it encrypted, where is the second copy, and when was a restore tested? |
| Protected cloud or remote backup | Can provide geographic separation and automated retention | Compromised credentials or an administrator account may delete or encrypt reachable copies | Are backups immutable or separately authenticated? Can the provider support a full restore during an outage? |
| System images plus file backups | Combines faster machine rebuilds with granular file recovery | Images may preserve compromised software or be too old for current work | How are images scanned and validated, and can a clean replacement be booted? |
Evaluate every method for separation from the production network, encryption, versioning and retention, restoration speed, capacity and successful recovery testing. No single medium eliminates the need for another recovery option.
Secure email, remote access and service providers
Email is an especially valuable starting point
Email often resets passwords, carries invoices and shares project files. Apply MFA to every mailbox, especially administrators, and remove forwarding rules or mailbox delegates that no longer have a business reason. Train staff to verify unexpected payment changes, urgent password requests and links that ask for sign-in. Use a known phone number from your records to confirm a request; do not rely on the number or reply address in the suspicious message.
Protect the account used to administer email and file sharing separately from a normal mailbox. Review sign-in alerts and forwarding settings after a suspected compromise. If your provider supports phishing-resistant MFA, prefer it for administrators and remote access.
Review remote access as a separate attack surface
Inventory VPNs, remote desktop, vendor support tools and cloud administration consoles. Disable services that are not required, restrict source locations where practical and require MFA. Do not share administrator passwords with a subcontractor or support company. Give a provider a named account with limited scope and an expiration or review date.
When a project or service relationship ends, remove the account and any saved tokens. Include subcontractors in onboarding and offboarding checklists: their credentials can expose shared folders, schedules or payment information even when they never use your office network.
Build a recovery order that matches how your company works
Write a one-page priority list rather than assuming every system can return at once. For each item, record the owner, dependencies, acceptable downtime, clean backup location and a manual workaround. A typical sequence might be:
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
- Safety and communications: establish a known-safe phone or messaging channel and a current contact list for employees, customers, insurers and responders.
- Identity and access: secure administrator accounts, reset credentials from a clean device and restore the minimum identity services needed for other systems.
- Core project records: restore the active-project folders and estimating or document systems required for crews and managers.
- Payroll and accounting: restore the records needed for the next payroll, payments and statutory deadlines, with independent verification of bank details.
- Scheduling and supporting applications: bring back dispatch, customer history and less urgent archives after the critical workflow is stable.
The actual order may differ. Dependencies matter: restoring a file server before identity controls are secured can re-expose clean data, and restoring a database without the matching application version can make it unusable.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat to do when ransomware is suspected
Speed matters, but uncontrolled improvisation can destroy evidence or spread the intrusion. Follow the written plan and use qualified IT or incident-response help.
- Recognize and record: note ransom messages, unusual extensions, disabled security tools, affected usernames, device names and times. Photograph the screen if doing so does not delay containment.
- Isolate affected endpoints: disconnect wired and wireless network access, unplug network cables and disable Wi-Fi or Bluetooth as appropriate. Do not power off a machine if your responder needs volatile evidence, unless immediate safety or spread requires it.
- Escalate network-wide containment: if multiple systems or segments appear affected, involve the IT or incident-response lead. CISA’s response checklist advises taking the network offline at the switch level where appropriate. Do not simply reconnect isolated devices to “see if they work.”
- Switch communications: use a known-safe device and separate channel to contact your IT provider, insurer if applicable, legal counsel and relevant authorities. Do not use a potentially compromised mailbox for sensitive coordination.
- Protect evidence and credentials: preserve relevant logs, ransom notes, alerts and backup records. Have responders assess whether attackers still have access before broad password resets or restoration.
- Validate backups: identify a known-clean restore point and verify that backup administration has not been compromised. Keep infected systems out of the recovery environment.
- Restore in the planned order: rebuild or clean systems, restore critical data, change credentials and monitor for reinfection. Record every action, decision and time for investigation, insurance and lessons learned.
Do not assume that paying a demand will restore data, remove the attacker or satisfy legal and insurance requirements. The cited CISA guide provides federal contact and reporting information; use its current official channels and follow applicable state, local, contractual and regulatory requirements.
Test the plan before a real outage
At least periodically, conduct a short exercise with the owner, operations lead, payroll or accounting lead and technology provider. Pick a realistic scenario such as “the project share and email are unavailable on payroll day.” Verify that participants can:
- Find the offline plan, asset inventory, backup instructions and contact list.
- Reach one another without company email.
- Identify which devices to isolate and who can authorize a network shutdown.
- Locate a clean backup and restore a sample project file and a representative database or system image.
- Explain how crews will receive schedules and how customers will receive accurate status updates.
- Document gaps, assign an owner and set a due date for each fix.
After an actual incident or significant software change, update the inventory, recovery order, credentials, provider contacts and restoration procedures. The CISA guidance on protecting data stored on devices and the CISA hardening guidance for managed service providers and small and mid-sized businesses provide additional implementation considerations.
Free tools Windows power users keep installed
One-click scans. No signup required.
A practical 30-day implementation plan
Days 1–7: close the largest account and recovery gaps
- Enable MFA on email, remote access, file storage and administrator accounts.
- List every administrator, remote-access and provider account; disable unused accounts.
- Identify the next payroll date and the project data required for safe operations.
- Disconnect any removable backup drive when it is not performing a backup or restore.
Days 8–14: make access and patching repeatable
- Assign an owner and schedule for operating-system, application, router and remote-access updates.
- Separate daily and administrator accounts and review third-party permissions.
- Remove obsolete forwarding rules, shared passwords and vendor access that lacks a business owner.
- Document how lost MFA devices are replaced and how former workers are offboarded.
Days 15–21: create and test protected backups
- Back up active projects, accounting, payroll, schedules, contacts and recovery configurations.
- Encrypt the copies and maintain an offline or otherwise isolated version with multiple retained points.
- Restore a sample file, a folder tree and one critical application or system image; record the time and result.
Days 22–30: rehearse the response
- Complete the inventory and recovery-priority list.
- Write the incident and communications plan, including alternate contact methods.
- Run a tabletop exercise, fix the gaps it exposes and schedule the next restoration test.
For a business without internal expertise, a managed IT or cybersecurity service can help with patching, monitoring, backup design and incident response. Verify the provider’s scope, access controls, response availability, recovery support and current terms directly; keep ownership of your inventory, credentials and recovery decisions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
