IT security: recommendations and things to avoid

A company’s IT security rests on a few simple rules: protected remote access, up-to-date systems, long passwords with two-step verification, backup and trained people. Since working from home and hybrid work became commonplace, many companies have replaced part of office life with videoconferencing and collaboration apps, and the security risks have moved along with them.

In this article, we present a set of recommendations, as well as the things to avoid when it comes to IT security.

Recommended: a well-secured VPN

A VPN became a necessity long ago. A computer connected to the VPN behaves as if it were at the company’s office. VPNs are used both to make remote work easier and to increase the security of the infrastructure.

We recommend investing in VPN technology, whether that’s a VPN server or a powerful UTM router that can support your company’s entire workload. Just as important: VPN access must be protected with two-step verification, and the equipment must be updated as soon as the manufacturer releases a security fix. Details in our article on why your company needs a high-performance VPN solution.

Avoid: putting off updates

Don’t put off updates, whether for the operating system or for applications. Updates don’t just bring new features; they also remove existing vulnerabilities.

The applications that should always be up to date are:

• antivirus and anti-malware solutions;
• your web browser;
• the operating system;
• the Office suite, these days mostly Microsoft 365;
• the applications you need for day-to-day work;
• cloud applications;
• the firmware of your router, firewall and other network equipment.

A system that is out of support no longer receives any security updates at all: Windows 10, for example, hasn’t received them for free since October 14, 2025. See how to do the free upgrade to Windows 11 and our article on end-of-life (EOL) technologies.

Since the security solution on your computers is a key part of your protection, we recommend choosing one that can be managed centrally from a cloud console, and whose alerts someone actually follows up on.

Recommended: long passwords and two-step verification

Implement a company-wide password policy. A good way to increase security is to stop allowing weak passwords. The recommendations have changed since 2021: NIST’s authentication guidelines, updated in 2025, put length ahead of complexity and no longer recommend changing passwords periodically. The rules can easily be enforced from the domain server or from Microsoft 365.

The most important measure, though, is two-step verification, turned on for all employees, especially for email and remote access.

Also, if your work involves many accounts and passwords, consider a team password manager. Details in our article with basic rules for creating secure passwords.

Avoid: untrained employees

However well secured your infrastructure is, don’t give up on in-house training programs that explain the main security concepts.

A few of the things every company employee should know:

• not to open suspicious emails or attachments;
• how to easily recognize phishing attacks;
• not to visit sites the company firewall flags as unsafe;
• to store sensitive data only on the company file server or in the company’s cloud storage solution;
• to confirm by phone, at a known number, any urgent payment request or bank account change received by email;
• not to copy company or client data into artificial intelligence tools the company hasn’t approved.

What other IT security mistakes should you avoid?

Besides those above, a few mistakes come up often in small and medium-sized companies:

• working every day with an administrator account, which lets any malicious program install itself unhindered;
• former employees’ accounts left active and shared passwords left unchanged after they leave;
• backups kept only on the same network as the data, where a ransomware attack can encrypt them along with it;
• Remote Desktop exposed directly to the internet, without a VPN and without two-step verification;
• ignored alerts: a security solution that sends warnings nobody reads protects nobody.

Recommended: work with an IT service provider

Turn to an IT outsourcing provider to lay the foundations of your company’s security. Preventing security problems is usually cheaper than recovering lost or compromised data. For companies that fall under the NIS2 Directive (in Romania, GEO 155/2024), these measures have also become legal obligations.

RezolvIT is a managed IT services company in Bucharest, ISO/IEC 27001 certified, that provides personalized IT support to the companies it works with, whether it’s IT security, securing laptops used at home or support with NIS2 compliance. We start with a free IT audit.