Cybersecurity for SMEs: the key areas to protect
Email, workstations, network, access, backup and people: the areas where an SME should focus its cybersecurity efforts.
Many small and medium-sized businesses think they are not an attractive target for cyber attacks. In reality, most attacks are not targeted: they hit whoever has weak defences, regardless of size. The good news is that a few well-protected areas greatly reduce the risk.
1. Email
It is still the main way in: phishing, malicious attachments, fake payment requests. You need advanced anti-spam and anti-malware filters, domain protection (SPF, DKIM, DMARC) and vigilance over unusual requests, especially those involving bank transfers or credentials.
2. Workstations and servers
PCs, laptops and servers must have up-to-date operating systems and modern endpoint protection, capable of recognising suspicious behaviour and not just known viruses. An unpatched device is often the starting point of an attack.
3. Network and remote access
Correctly configured firewalls, separate networks for guests and machinery, VPNs for those working off-site. Remote access exposed to the Internet without adequate protection is one of the most frequent causes of incidents.
4. Identities and passwords
Reused passwords and accounts without multi-factor authentication are a gift to attackers. MFA on email, cloud services and remote access is one of the most cost-effective measures available. Accounts belonging to people who have left the company should also be disabled immediately.
5. Backup
If everything else fails, backup is what allows you to recover. It must be automatic, verified and include at least one copy kept separate from the company network, so that it is not encrypted along with the data in a ransomware attack.
6. People
Technology is not enough if people cannot recognise a scam attempt. Short training sessions and regular simulations greatly improve the ability to respond.
Where to start
The first step is a snapshot of the current situation: what is there, what is exposed, what is missing. With its Cybersecurity service, Labinf Sistemi helps companies and organisations assess risks and put proportionate protection in place, using partner technologies such as Sophos, alongside backup and disaster recovery and continuous monitoring.
Want to know how well protected your business is? Contact us for an initial discussion.
