In summary
- Dedicated firewall with network segmentation between critical systems, workstations, and visitors.
- Tested backups, with at least one offline or immutable copy.
- Multi-factor authentication in the email and in all remote access.
- Managed security updates, not left to the discretion of each user.
- Staff training — the majority of incidents come in via email.
In this article
- 1. Dedicated firewall and network segmentation
- Tested backups — not just made
- 3. Multi-factor authentication (MFA)
- Managed security updates
- 5. Employee training and awareness
- 6. Access control and principle of least privilege
- 7. VPN for remote access
- 8. Continuous monitoring
- 9. Incident response plan
- Where to start
Most cyber attacks on Portuguese SMEs do not target large corporations — they target smaller companies precisely because, on average, they have fewer defences in place. This checklist brings together the essential protections that any SME should have in place, regardless of its sector of activity.
1. Dedicated firewall and network segmentation
A correctly configured firewall is the first barrier between the company's internal network and the outside world. In companies with multiple departments or device types, VLAN segmentation limits the impact of a potentially compromised device, preventing an isolated incident from spreading across the entire network.
The typical target is not the large company. Most attacks on Portuguese organisations target smaller companies precisely because they have, on average, fewer defences in place.
Tested backups — not just made
Having backups is not the same as having backups that work. Many companies only discover that a backup is corrupted or incomplete at the very moment they need it most. Good practice includes the 3-2-1 rule (three copies, on two different types of media, one of them off-site) and periodic restore tests, not just confirmation that the backup “ran without errors”.
3. Multi-factor authentication (MFA)
A compromised password is no longer enough for an attacker to access email, files, or critical applications when a second factor of authentication is active. It is one of the most cost-effective measures in cybersecurity, and it should be active for all corporate email, VPN, and management application access.
Managed security updates
Outdated operating systems, management software and network equipment firmware are one of the most common entry points for cyber attacks. Centralised update management — rather than relying on each employee to update their own equipment — ensures that these patches reach all workstations consistently.
5. Employee training and awareness
Most security incidents begin with a human action — clicking on a phishing link, a shared password, an unverified attachment opened. Periodic awareness sessions, even short ones, significantly reduce this type of risk.
6. Access control and principle of least privilege
Every employee should have access only to the systems and data necessary for their role — no more than that. This limits the impact of a compromised account and makes it easier to audit who accesses what information. Centralised access management, via Active Directory or equivalent, is the most efficient way to apply this principle.
7. VPN for remote access
With the growth of remote and hybrid working, access to company systems from abroad must be done exclusively via an encrypted VPN, never through direct, unprotected connections to the internal network.
8. Continuous monitoring
A successful attack is rarely instantaneous — there are usually signs of anomalous activity before the actual impact (repeated access attempts, network traffic outside the usual pattern, unauthorised changes). 24/7 monitoring makes it possible to detect and react to these signs before they become a serious incident.
9. Incident response plan
Knowing in advance who to contact, which systems to isolate first and how to communicate internally in the event of an incident drastically reduces response time — and, consequently, the impact of the incident itself.
Where to start
If your company does not have the majority of these points implemented, the most efficient approach is not to try to resolve everything at once, but rather to start with an audit of the current infrastructure, which identifies the most critical gaps and prioritises the fixes with the greatest impact relative to the risk.
DataRoad — IT services for businesses
A DataRoad is a Portuguese company specialising in managed IT services (MSP), headquartered in Alfragide (Lisbon) and with an active presence in Porto, Faro, Funchal, Évora, Setúbal and Beja. Since 2015, it has ensured the smooth running of IT infrastructures for businesses that cannot afford downtime — hotels, clinics, embassies, universities, multinationals and demanding SMEs — with a certified technical team, continuous monitoring and 24/7 support.
DataRoad supports businesses that rely on technology to operate — from network infrastructure to cybersecurity, and from servers and backups to day-to-day support — with a model of managed service (MSP) which ensures continuity, performance and cost predictability.
DataRoad Services
- IT Unlimited — round-the-clock IT support: unlimited support at a fixed cost, both remote and on-site, with incident management and rapid response.
- Computer networks and structured cabling: network design, installation and certification; Layer 3 switching and PoE.
- Enterprise wireless networks (Wi-Fi 6 and Wi-Fi 7): coverage study, cloud management and isolated visitor networks.
- Cybersecurity and corporate firewalls: perimeter protection, traffic control and threat mitigation.
- Servers, backups and disaster recovery: servers, NAS devices and centralised backups.
- CCTV video surveillance: video surveillance systems with continuous recording.
- Monitoring, alarm systems and reporting: real-time monitoring, automatic alerts and proactive interventions.
- IT consultancy and project management: relocation of premises, new facilities and modernisation of infrastructure.
- Cross-platform support: Windows and Apple environments, with comprehensive management of the IT infrastructure.
Get in touch with DataRoad
Would you like to know whether your company’s network is truly secure? We’ll carry out an assessment and provide you with a no-obligation quote.
