Most businesses that suffer a serious security incident are not targeted because of who they are. They are targeted because of what was exposed, and because the attacker's tools found it first. That is good news in one sense: the protections that matter are well understood and mostly affordable. The difficulty is doing them consistently.
Where incidents actually start
Across the incidents we have helped clients recover from, the entry points are remarkably consistent.
- Compromised credentials, usually a reused password or an account without multi-factor authentication.
- Phishing, increasingly well written and often impersonating a supplier, a bank or a senior colleague.
- Unpatched, internet-facing systems: a VPN appliance, a file transfer tool, a forgotten test server.
- Over-permissioned third parties, from an integration with a partner to a contractor's leftover account.
Ransomware, data theft and business email compromise are what follows. Preventing the entry point is far cheaper than responding to the outcome.
The controls that matter most
If a business does nothing else this year, these five changes reduce risk the most for the least effort.
- Turn on multi-factor authentication everywhere, including email, remote access, cloud consoles and finance systems. Prefer app-based or hardware methods over SMS where you can.
- Know what you expose. Keep a list of every service reachable from the internet, who owns it, and when it was last updated. Remove what is not needed.
- Patch on a schedule. Critical updates to internet-facing systems within days, everything else within a defined window. Automate what can be automated.
- Back up, and test the restore. Keep at least one copy offline or immutable so ransomware cannot reach it, and practise recovering a system from it.
- Prepare for the bad day. A one-page plan naming who decides, who communicates and who to call, kept somewhere that still works if email is down.
Train people for the attacks they will see
Generic awareness training has limited effect. What works is short, specific practice: show staff the invoice fraud email that targets your finance team, the fake login page for the tools you actually use, and the phone call that claims to be from IT. Make it easy to report a suspicious message and respond when they do.
When to bring in help
An external assessment is worthwhile when you do not have a clear answer to "what is exposed and who can get in", or when a customer, regulator or insurer is asking for evidence of your controls. CTC Tech Services provides focused security assessments, hardening work and ongoing managed support for organisations that need a security capability without building a full team.
