The idea that cyber attacks only target large organisations is common, and wrong. Small and medium-sized businesses are often easier targets because their defences are weaker. Ransomware, phishing emails and compromised accounts are the most frequent threats. The good news is that most of the most effective measures are neither complex nor expensive.
1. Multi-factor authentication
Enforce multi-factor authentication (MFA) on email, cloud services and admin panels. Even if a password is stolen, MFA largely prevents the account from being misused.
2. Strong, unique passwords
Use a different, strong password for every system, managed in a business password manager. Get rid of shared passwords.
3. Regular, isolated backups
Back up critical data regularly and keep at least one copy offline or immutable. If you have not tested a restore, you cannot be sure you have a backup.
4. Do not delay updates
Automate security updates for operating systems, browsers, servers and business applications. Many attacks exploit vulnerabilities that were patched long ago.
5. Email security
Configure SPF, DKIM and DMARC for your domain to make spoofing your company harder, and filter malicious attachments and links in incoming mail.
6. Staff awareness
Most attacks start with one click. Run short, regular training on spotting phishing, verifying unusual payment requests and reporting incidents.
7. Least privilege
Give users only the access their work requires. Do not use admin accounts for daily work, and remove access for leavers on their last day.
8. Endpoint protection
Run up-to-date endpoint protection on every computer and server, enable disk encryption and manage devices centrally.
9. Network and remote access
Configure the firewall properly, separate the guest network from the company network and allow remote access only through VPN or secure access solutions.
10. Incident response plan
Decide in advance who does what during an attack: isolating systems, restoring from backup, informing customers and, where required, the authorities. Include data breach notification duties under the applicable data protection law.
Where to start
A short security assessment reveals the biggest risks and the quickest wins. For most businesses, MFA, backups, updates and email security can be completed within the first 30 days.
ujans offers cyber security services covering security assessments, identity and access management, backup, endpoint protection and staff awareness training.