In this article
A cyberattack on a company does not happen on the night the files appear encrypted. The attacker got in days or weeks earlier, moved through the network, found and deleted the backups and only then pressed the button. There are four phases (reconnaissance, entry, expansion and impact) and in each there is a measure that works. The earlier the attack is stopped, the cheaper it is. This is how we see incidents at Portuguese SMEs, and this is how we design managed cybersecurity.
The four phases at a glance
| Phase | What the attacker does | Typical duration | What stops it |
|---|---|---|---|
| 1. Reconnaissance | Studies the company using public information | Hours to weeks | Unique passwords, less exposure |
| 2. Entry | Phishing, an exposed service or an unpatched flaw | Minutes | MFA, filtering, updates, managed firewall |
| 3. Expansion | Looks for credentials, servers and backups | Days to weeks | VLANs, no local administrators, immutable backups, monitoring |
| 4. Impact | Encrypts, steals or diverts payments | Hours | Containment: response and recovery plan |
1. Reconnaissance: the company seen from outside
Before the first contact, the attacker gathers what is public: names and job titles on LinkedIn, email addresses on the website, suppliers mentioned in the news, software named in job adverts and employee passwords exposed in leaks from other sites. With that, they build a tailored attack: the usual supplier's email, the call from the bank, the login with the reused password. The company sees nothing of this phase.
How to stop it: take the value out of the keys and reduce what is exposed. Unique passwords stored in a business password manager neutralise third-party leaks. Fewer generic email addresses on the website and a procedure for requests made in someone else's name reduce the room for social engineering.
2. Entry: the first door
At SMEs there are three dominant doors:
- Phishing Someone types their password into a fake site or opens a malicious attachment.
- Exposed service without MFA Remote desktop, VPN or an old portal with a weak password.
- Unpatched flaw A firewall with old firmware, an out-of-date server, Windows 10 without support.
How to stop it: multi-factor authentication on everything accessible from outside, which makes a stolen password useless. Email filtering and a team trained to recognise and report. Updates kept current and a managed firewall with the minimum of exposed services. This is where most attacks on SMEs should die.
3. Expansion: from one workstation to the whole network
Once inside, the attacker looks for three things: administrator credentials, a path to the servers and the backups. On a flat network, with users who are administrators of their own machines and the same admin password on every device, they get there in hours. They disable the antivirus, create accounts to come back and delete or encrypt whatever backups are within reach.
How to stop it:
- Segmentation VLANs that prevent a compromised workstation from reaching servers and backups (how to segment the network).
- Least privilege Users without administrator rights.
- Immutable backups Out of the network's reach.
- Detection A NOC and monitoring (24/7 on the Premium 365 plan) that catches out-of-hours logins, new accounts and traffic to strange destinations while they are still just alerts.
This is the logic behind the four Zero Trust steps for SMEs.
Why this is the decisive phase
Entry is never 100% closed: people make mistakes and new vulnerabilities appear every day. Impact is too late for prevention. During expansion, a company with segmentation, monitoring and protected backups turns a serious incident into one workstation to reinstall. Even so, it is the most neglected phase: money goes on the door (firewall, antivirus) and on recovery (backups), and the middle is left open.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
4. Impact: what you finally see
Encrypted files with a ransom demand, data published or sold, fraudulent transfers or systems at a standstill. The timing is chosen to delay the response, often a Friday night or the eve of a public holiday. The cost is now measured in days of downtime, recovery fees, notifications to the CNPD (Portugal's data protection authority) and to clients, and reputation.
How to contain it: a written response plan that everyone knows (who isolates, who communicates, who calls whom); backups that are tested and out of the attacker's reach; a disaster recovery and business continuity plan with defined recovery times; and well-managed first hours, as our guide to data recovery in the first hours explains.
A typical attack, day by day
A composite scenario based on what we see at SMEs.
- Tuesday — someone in accounts receives an invoice from the "supplier" and types their password into the fake portal.
- Tuesday night — the attacker gets into the mailbox and reads for a week. They find access to the remote desktop, without MFA.
- The following days — they get into the network; the user is a local administrator; they extract credentials and reach the file server and the backup NAS, on the same segment.
- Thursday night — they delete the backups.
- Early Saturday morning — they encrypt everything. On Monday morning, the company finds out.
With MFA on remote access, it would have stopped at phase 2. With VLANs and backups off the network, it would have stopped at phase 3 with one server to restore. With none of these measures, it meant three weeks of partial shutdown.
Frequently asked questions
How long passes between entry and impact?
At SMEs, usually between a few days and a few weeks. Automated attacks can encrypt within hours; targeted ones take longer because the attacker looks for the backups first.
Isn't a good antivirus enough?
It stops part of the entry (malicious attachments) and part of the expansion (known tools). It does not stop stolen credentials used in an apparently legitimate way, which is how most attacks progress. That is why MFA and segmentation carry more weight.
Does paying the ransom solve it?
It guarantees neither recovery nor that the data will not be published, and it funds the next attack. Those with tested backups out of reach never even have to decide.
Where do we start if we have none of this?
By cost-benefit: MFA on all external access, backups off the network and tested, removing administrator rights, segmenting the network. The first two can be done in days.
Next step: at what phase would an attack on your company be stopped today?
We walk through the four phases with your infrastructure and tell you in writing where an attack would be stopped today and what is missing to stop it earlier. Discover DataRoad managed cybersecurity; in 11 years, DataRoad has never suffered a security incident.
More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950* or write to sales@dataroad.pt.
*Call to a Portuguese landline.
