There are different ways to approach this, including:
- Mitigation of the infection
- Filtering emails better
- Educating users
As your question regards the mitigation of a infection, I will keep the other parts short.
The problem are not only attachments but also html emails that could directly attack the email client - or contain fraudulent links.
Depending on the business, this method may or may not be applicable:
Deploy greylisting in conjunction with an attachment check and SPF and/or DKIM. E.g.
That sender is new to me - it has an attachment. If the DKIM signature cannot be verified, I'm not letting this through.
Mitigating the risks
Again, this depends on your business. If there isn't loads of data being used (and written to), this might be a possibility:
Have a "staging area" for each login session - e.g. the "Documents" directory being the only directory with write access for users.
Then, they may write new files (or open read-only old files and edit them) there - the sandbox get's then migrated to permanent storage with a logout script, changing permissions to read only.
The problem with this is: if the malware uses priviledge escalation, there is a chance it changes permissions and encrypts anyhow.
There is also another question (by me) here that has higher demands on the write access, maybe that helps you.
The key point is to rescrict write access as much as possible - maybe introducing some organizational overhead with manually requesting rights from the sysadmin, but minimizing the damage that can be done.
As FerryBig pointed out in the comments: of course all software should be kept up-to-date at all time (with verified updates) and no software should be used that is discontinued or known to have unfixed vulnerabilities (looking at you, flash!).
Basically, even not-suspicous looking file attachments are a bad idea.
The general rule of thumb would be to not open attachments that are not expected. Cross reference this answer on malware infection, also - unfortunately, also by me.