IT security for businesses: 10 steps that will protect you

Cyber attacks are not just a problem for large corporations. On the contrary, small and medium-sized enterprises are popular targets for attackers, as they often have weaker security and fewer resources for defence. Every third cyber attack is aimed precisely at small businesses.

The good news is that you can defend against it. And it doesn't have to cost millions. Here are 10 concrete steps that will significantly increase your company's security.

1. Install a high-quality firewall

A firewall is the first line of defence for your network. It monitors all traffic between the internet and your corporate network. A home router from your internet provider is not enough. You need an enterprise firewall capable of filtering traffic, blocking dangerous websites and detecting suspicious activity.

Investment: 5 000-20 000 Kč depending on company size. An investment that pays for itself after the first blocked attack.

2. Use business antivirus software

A free antivirus for households is insufficient for businesses. Business antivirus (ESET, Bitdefender, Microsoft Defender for Business) offers centralised management. You can view the status of all computers from one location, remotely launch scans and respond immediately to threats.

Price: 500-1 200 Kč per year per computer. Includes regular virus database updates and real-time protection.

3. Enable multi-factor authentication (MFA)

A password alone is not enough. Multi-factor authentication (MFA) adds a second step to the login process: typically a code from a mobile app. Even if an attacker obtains your password, they cannot log in without the second factor.

MFA is absolutely essential for:

• Email accounts (Microsoft 365, Google Workspace)
• Remote access (VPN, remote desktop)
• Banking and accounting systems
• Administrator accounts on all systems

Costs: none. Microsoft Authenticator and Google Authenticator are free of charge.

4. Set password policy

Weak passwords are the most common cause of security incidents. A proper password policy includes:

• Minimum length of 12 characters
• A combination of uppercase and lowercase letters, numbers and special characters
• Unique password for each service
• Using a password manager (Bitwarden, 1Password, KeePass)
• Prohibition on sharing passwords between employees

A password manager is essential, employees do not need to remember dozens of complex passwords. They remember one main password and the application handles the rest for them.

5. Update everything regularly

Most successful attacks exploit known vulnerabilities in outdated software. Updates are not just annoying pop-ups; they are security patches that close the door on attackers.

What must always be up to date:

• Operating system (Windows, macOS)
• Office software (Microsoft Office / 365)
• Web browser
• Firmware for network devices (router, switch, access point)
• All other software

6. Train employees

The human factor is the weakest link in security. Even the most sophisticated firewall will not help if an employee clicks a link in a phishing email or shares a password over the phone.

Regular training (at least once a year) should cover:

• Recognising Phishing Emails
• Safe handling of passwords
• What to do if an incident is suspected
• Rules for working from home and using public Wi-Fi

7. Back up according to the 3-2-1 rule

Backups are your last line of defence. If everything else fails, ransomware encrypts the data, a drive is destroyed, or an employee deletes an important folder: a backup will save you.

Rule 3-2-1: 3 copies of data, on 2 different media, 1 copy off-site. We have written about this in detail at guides to advance payments for companies.

8. Restrict access rights

Not every employee needs access to everything. The principle of least privilege means that each person has access only to what is necessary for their work. An accountant does not need an administrator account. A receptionist does not need access to financial data.

Specifically:

• Employees work under standard accounts, not administrative ones.
• Shared folders have permissions set: defining who can read and modify what.
• When an employee leaves, all their access rights are immediately deactivated.

9. Secure remote access

Working from home is common, but it must be secure. Connecting via the public internet without protection is like leaving your office door open.

For secure remote access use company VPN, which encrypts all communication. Never expose the remote desktop (RDP) directly to the internet. It is one of the most common entry points for attackers.

10. Have a plan in case of an incident

Even with the best security, something can go wrong. It is important to know what to do:

1. Who is the contact person for security incidents?
2. How to disconnect a compromised computer from the network?
3. Where are deposits held and how are they replenished?
4. Who to notify (clients, authorities) in the event of a data breach?
5. How to restore operation as quickly as possible?

This plan does not need to be a hundred-page document. A simple one-page procedure known by everyone in the company is sufficient.

How much does basic company security cost

For a company with 10 computers, as an estimate:

• Corporate firewall: 8,000-15,000 Kč one-off
• Business antivirus: 5,000-12,000 Kč per year
• MFA: free of charge
• Password manager: 2 000-5 000 Kč per year
• Configuration and setup: 5,000-10,000 Kč

In total approximately 20 000-40 000 Kč for the first year. Compare this with the average cost of a cyber incident at a small business, which runs into hundreds of thousands.

As IT Administrator for Companies in Prague 1 We assist small businesses with comprehensive IT security, from auditing the current state to implementing all mentioned measures.