Why small companies are affected too
Attackers do not look for specific companies but for open doors: unpatched systems, weak passwords, exposed services. Closing these doors takes you out of reach of most automated attacks. The following ten measures cover the most common entry points.
The ten measures at a glance
- 1. Inventory: do you know which devices, servers, cloud services and accounts exist? What is unknown is not protected.
- 2. Updates: update operating systems, applications, routers and firewalls promptly, with a clear process (see patch management).
- 3. Backups: regular, stored separately and with a tested restore (3-2-1 rule).
- 4. Multi-factor authentication: at least for email, remote access and administrator accounts.
- 5. Passwords: a password manager instead of notes, spreadsheets and reuse.
- 6. Least privilege: everyday work without administrator rights, administrator accounts kept separate.
- 7. Endpoint protection: current protection software, disk encryption, screen lock.
- 8. Network: firewall, separate guest Wi-Fi, only necessary services reachable from the internet.
- 9. Awareness: short, regular training on phishing and social engineering.
- 10. Emergency plan: written down, with phone numbers and a clear first hour.
Where to start
Start with backups, multi-factor authentication and updates. These three prevent or limit most damage. Permission concept, password manager and emergency plan follow. What matters is the order by impact, not completeness on day one.
How we help
In an initial security check we assess where your environment stands and produce a prioritised list that even a small team can implement. This fits our managed security area in Bamberg and Upper Franconia.