What to do and not do before a ransomware attack