- compartmentalization of files and folders, not having "excessively open" file and folder permissions that would prevent the less-educated, less tech-savvy, and less reliable employees from being able to do too much damage if they screw up How does this prevent ransomware?
The folder permissions thing helps limit the impact of ransomware because don't forget, it's only running as the user who opened it, so it only has as many permissions as they do. Sure, it could maybe use some exploit to get local administrator access on the desktop it's running on, but who gives a shit if a desktop gets encrypted? Just reimage it and move on. It's the files on the servers that need to be protected.
I do think it's an absolute crime though that anti-virus vendors sell anti-ransomware as an entirely separate (and expensive) product and don't include this functionality in their main programs. Sophos Intercept-X, I'm looking at you here.