Many organisations have the wrong picture of cybersecurity: they think it is expensive and complicated, and that they are not interesting to criminals. That is a classic mistake. Even the simplest data can be stolen and resold, with all the consequences that brings. And criminals do not even need to target you: whether you have ten employees or are a multinational, a hole will be found and exploited.
That is why we recommend five fundamental actions, as described in the first edition of The Digital Compass. With these in place, you are already a lot more secure than most organisations.
Action 1: handle login details securely
A password alone is no longer security. Criminals have access to billions of stolen passwords and test them automatically on other services.
- Require two-step verification (2FA) on all important accounts: email, accounting, CRM and cloud storage. If a service supports passkeys, even better.
- Use a password manager for unique, strong passwords. Even a password notebook is better than the same password everywhere.
- Be suspicious by default and require verification before granting access, including to suppliers and external parties.
Read more: A password policy that actually works.
Action 2: backups, your plan B
Ransomware encrypts your files and criminals demand a ransom. With a recent, secure backup you can get back to work without paying. But a backup is not a backup if you cannot restore it.
- Set up automatic backups of all important systems and files.
- Keep an offline backup that is separate from your network.
- Regularly test that your backup works and that you can actually restore it.
- Encrypt your backups.
Read more: Backups: why OneDrive is not a backup and Ransomware: how criminals hold your organisation hostage.
Action 3: updates and patches, close the back door
Most attacks exploit known vulnerabilities for which a fix has long existed. Yet updates are often postponed for months. An unpatched vulnerability is an open back door.
- Enable automatic updates for all software and devices.
- Stop using software that no longer receives updates, such as old versions of Windows.
- Keep track of which software and devices are in use in your organisation, so nothing is left unprotected.
Read more: Software updates: take control before attackers do.
Action 4: email security, incoming and outgoing
Email is still the main attack channel. And the risk is not only in what comes in: if criminals misuse your domain, they harm your customers and your reputation.
- Set up SPF, DKIM and DMARC, so nobody can simply send email on behalf of your domain. The free domain check shows how your domain is doing.
- Have incoming email scanned automatically for suspicious attachments and links.
- Train employees to recognise suspicious email, including CEO fraud and invoice fraud.
Read more: From none to reject and Invoice fraud in four phases.
Action 5: secure behaviour as a daily habit
You do not achieve behavioural change with a one-off training or an annual phishing test. Secure choices have to become the default. Cybersecurity is not an IT problem, but a topic for the whole organisation.
- Make digital security part of the culture, not something ‘IT takes care of’.
- Involve employees actively and make them share responsibility.
- Create a blame-free reporting culture, so everyone dares to report suspicious situations straight away.
- Keep repeating and practising, for example with regular checks and realistic scenarios.
Where do you stand?
You do not need to be an expert. You just need to make sure the basics are in order. Assess your organisation with the checklist from The Digital Compass, or take the free Cybercheck.
More in The Digital Compass
An extended version with an explanation for each action, and many more practical tips, can be found in the first edition of The Digital Compass (in Dutch).
