Key takeaways
- A short list of controls stops most everyday attacks.
- Start with multi-factor authentication, patching, backups and email protection.
- Add monitoring and a written plan so a bad day does not become a crisis.
Why a short list works
Small and mid-sized businesses are attacked for the same reasons as large ones: money, data and access to other companies. What they lack is time and a dedicated security team. The good news is that a short list of controls stops most real-world attacks. Here are ten, in the order we usually recommend adding them.
The ten controls
- 1Turn on multi-factor authentication everywhere. Stolen passwords are the most common way in. MFA on email, VPN, cloud consoles and admin accounts blocks the vast majority of those attempts. Start with administrators and finance staff.
- 2Keep systems and software patched. Attackers scan the internet for known flaws within hours of publication. Automate updates for operating systems, browsers and internet-facing software, and track anything you cannot patch quickly.
- 3Back up, and test the restore. Backups are your last defence against ransomware, but only if they are offline or immutable and you have actually restored from them. Test a restore every quarter.
- 4Protect every device with modern endpoint security. Replace basic antivirus with endpoint detection and response that watches behaviour, not only known files. Include laptops, servers and, where possible, phones.
- 5Secure email. Most attacks start with a message. Enable filtering, block lookalike domains, set SPF, DKIM and DMARC, and give staff a one-click way to report suspicious mail.
- 6Limit who can do what. Give people only the access they need, review it twice a year, and remove accounts the day someone leaves. Separate admin accounts from daily accounts.
- 7Know what you have. You cannot protect systems you do not know about. Keep a living list of devices, cloud accounts, applications and the data they hold.
- 8Train people, then test them. Short, regular training works better than an annual lecture. Run phishing drills and treat results as learning, not blame.
- 9Watch for trouble, around the clock. Attacks happen at night and on weekends. Collect logs from key systems and make sure someone, or a managed service, reviews alerts and can act quickly.
- 10Write down the plan for a bad day. Decide who leads, who calls whom and what gets shut off first. A one-page plan and a two-hour practice session beat a long document nobody reads.
Where to start
Do not try to do everything at once. Pick the first three, set a date for each and name an owner. Then book a short assessment to see which gaps matter most for your business. If you do not have a team to run monitoring and response, managed SOC and detection gives you round-the-clock coverage, and the Optimus CyberX platform brings the results together in one console.
A simple 90-day order
- Days 1 to 30: multi-factor authentication, automatic updates, email protection.
- Days 31 to 60: tested backups, endpoint protection on every device, access cleanup.
- Days 61 to 90: monitoring, awareness training and a written incident plan with a short practice run.
Further reading
Independent sources we recommend for more detail.