IT security for companies

The measures below are the minimum that public guidelines recommend to small and medium-sized businesses: the ENISA cybersecurity guide for SMEs, the basic group of the CIS Controls (IG1, known as “essential cyber hygiene”) and the measures in Article 21 of the NIS2 directive. Any company can apply them, with its own team or with an IT provider.

1. Appoint someone in management to own it. Security needs someone who decides the budget, the rules and the priorities. NIS2 makes management accountable for security measures.
2. Take inventory. List the computers, phones, servers, software, accounts and important data. You can’t protect what you don’t know you have.
3. Turn on automatic updates. For the operating system, applications, browsers and the firmware of routers and printers. Whatever doesn’t update itself gets checked monthly.
4. Turn on multi-factor authentication (MFA). Start with email, remote access and administrator accounts. That way, a stolen password is no longer enough to get into an account.
5. Use long, unique passwords, in a password manager. ENISA recommends passphrases of at least three randomly chosen words. No password is used in two places or sent to colleagues.
6. Give everyone only the access they need. Nobody works on an administrator account day to day, and the accounts of people who leave are closed on their last day.
7. Install centrally managed antivirus on every device. Its alerts have to reach someone. No pirated software: it can contain malware. Where the data matters, add EDR (see the next section).
8. Filter email and web browsing. Block spam, links to malicious sites and dangerous attachments. Email is one of the most common ways in for attackers.
9. Put a firewall in place and check remote access. Access from outside the office goes only through an up-to-date VPN with MFA, never through Remote Desktop (RDP) open directly to the internet, and only to the systems each person needs.
10. Encrypt laptops and phones. With BitLocker on Windows, FileVault on Mac and phone encryption, a lost laptop doesn’t become a data leak.
11. Back up following the 3-2-1-1-0 rule and test restores. Three copies, on two types of media, one off site, one offline or immutable, and zero errors in the restore test. ENISA asks for automatic, encrypted copies kept separate from the company network.
12. Manage the phones and laptops that can reach company data. A mobile device management (MDM) solution shows who can access company email, checks that the device is encrypted and up to date, and wipes the data remotely if it’s lost or the employee leaves.
13. Train people, with real examples. Regular sessions, phishing simulations and written rules on using the company’s equipment and data.
14. Write the incident response plan. Who decides, who you call (the IT provider, the insurer, the national cybersecurity authority), how you isolate computers and where the backups are. Keep a printed copy too, not just on the server that may get locked.
15. Keep suppliers in check and review yourself regularly. Suppliers get access only for as long as they need it, with separate accounts and security obligations in the contract. A regular audit, by someone independent from the people who run IT day to day, shows what has slipped through.

The steps below follow the ransomware response checklist of CISA, the US cybersecurity agency, and the recommendations of DNSC, Romania’s national cybersecurity authority. Keep them printed, next to the incident response plan.

1. Isolate the affected computers. Unplug the network cable and turn off Wi-Fi. If several are affected, disconnect the company network from the internet.
2. Don’t turn the computers off if you can isolate them. Their memory holds traces that are useful for the investigation. Powering down is the last resort, only if you can’t disconnect them any other way.
3. Talk on the phone, not over company email. Attackers may still be reading the messages in compromised accounts.
4. Don’t pay the ransom. DNSC, CISA and the No More Ransom project advise against paying: payment funds the attackers and doesn’t guarantee you’ll get your data back.
5. Report the incident. In Romania, to DNSC, on 1911 (24/7) or on the PNRISC platform. Companies covered by NIS2 send, for significant incidents, an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. If personal data is affected, you also notify the data protection authority (in Romania, ANSPDCP) within 72 hours at the latest (GDPR, Article 33). Tell your insurer too, if the company has a cyber insurance policy.
6. Look for a free decryptor. On No More Ransom, a project backed by Europol, you can find out whether there’s a free key for the type of ransomware that hit you.
7. Find out how the attackers got in. The account, computer or server where the attack started. Until you close that path, restored systems can be attacked again.
8. Restore from backup only onto clean systems. Clean or reinstall the systems first, then restore, starting with the ones the business depends on. Check that the backup isn’t infected too.
9. Change passwords after the cleanup and turn on MFA everywhere. Changed too early, the new passwords can end up with the attackers too.

If you’re a RezolvIT client, call the helpdesk on 031 432 8680: we connect remotely within one hour, as with any incident.

Ransomware attacks, data theft and lost files can bring a company to a standstill. We handle IT security end to end, from antivirus and backup to remote access. RezolvIT is certified to ISO 9001:2015 and ISO/IEC 27001, for its information security management system.

With the Business Unlimited plan, the Bitdefender license is included, and your computers and servers are monitored 24/7 and updated automatically through MspCoreX. On top of it, we manage EDR, XDR and MDR solutions from Bitdefender, Microsoft and Fortinet on request.

The layers we manage

• Computers and servers: the Bitdefender license, Windows security updates, antivirus, firewall, Microsoft 365, firmware and driver updates, applied automatically through MspCoreX, and 24/7 monitoring, with Business Unlimited;
• Data: Backup as a Service, with encrypted, immutable copies kept in the European Union, and a written recovery plan;
• Access: access rights on file servers, accounts closed for employees who leave, two-step verification wherever possible, VPN for working from home;
• Network: firewall, secure Wi-Fi and managed network equipment, through IT infrastructure;
• People and rules: IT training for employees and business continuity and disaster recovery procedures; on request, an ISO/IEC 27001 security audit, a GDPR audit and support with NIS2 (in Romania, GEO 155/2024).

Backup solutions

• our backup solutions take away the worry of losing your data or having it compromised: details on the Backup as a Service page

Disaster recovery

• we offer IT infrastructure consolidation services that help prevent disasters and recover data
• we help you make better use of your systems and resources, lower your total cost of ownership (TCO) and prevent downtime
• we set up business continuity and disaster recovery procedures

VPN

• we help you use Wi-Fi networks on the road without exposing your activity
• we configure VPN connections tailored to your business’s needs

That way, you can run your business safely online.

Virus removal

• our technicians can connect to your computer remotely to remove infections manually, with specialized tools

Encryption

• our solutions are compatible with a wide range of current technologies and standards
• we offer you the best solutions for your needs

Security audits and NIS2

On request, we run vulnerability scans, IT security tests, ISO/IEC 27001 security audits and GDPR audits. We also offer support with NIS2 compliance (in Romania, GEO 155/2024). It all starts with a free IT audit.

Find out more about what outsourcing IT services involves on our blog, see references from other clients or book a meeting with a RezolvIT specialist.