Three-phase ransomware protection strategy