What a protection system is
When a company looks for “cyberattack protection”, it usually gets a list of technologies: antivirus, firewall, monitoring. This is the necessary but smaller part of the picture. A protection system answers two questions at once: how to make a successful attack unlikely, and what will happen to the business if it happens anyway. The second question is less pleasant, so it is skipped more often.
One in three successful attacks on companies comes through contractors and partners, and a third start with stolen credentials. Both routes bypass your perimeter, however expensive its protection is.
The technical half: basic hygiene
- Updates: most attacks exploit long-known vulnerabilities for which patches exist.
- Multi-factor authentication wherever there is remote access or admin rights.
- Backups under the 3-2-1 rule with an isolated copy (details in the article on ransomware protection).
- Network segmentation and least-privilege access.
- Monitoring and logging: you cannot stop an attack you cannot see.
Organisational measures: cheaper and more important
The most underrated part of protection is the measures that cost almost nothing, because existing staff do them within their current salaries:
- Incident response procedure: who disconnects, who decides, who calls the lawyers and the insurer.
- Prepared communications: what to tell employees, customers and the press in the first hours. Companies that stay silent, lie or contradict themselves lose more on reputation than on downtime. More in the article why companies hide cyberattacks.
- Training people: phishing remains the main way in. One hour of training per quarter noticeably reduces how often people click on lures.
- Requirements for contractors: access rights, VPN, an obligation to report incidents.
The second half: resilience to a successful attack
Suppose the attack got through. From then on, four things decide the outcome: isolated copies, a rehearsed recovery plan, workarounds for critical operations and ready communications. This is business continuity: the discipline that starts where the capabilities of information security end. The good news: this half of protection is mostly organisational, so it depends on management will more than on a hardware budget.
How to measure protection in money
A protection budget becomes justified when two figures stand side by side: the cost of an hour of downtime of key processes and the current recovery time. We bring them together on one screen: the continuity dashboard shows a resilience index of 0-100, the cost of downtime and the weak spots. With this screen, the conversation about the protection budget turns from “how much can we spare” into an investment decision. You can see where one rouble spent on protection saves ten roubles of losses, and where you are already overprotected and can stop spending.
Frequently asked questions
Where should a small business start? Four steps with almost no budget: multi-factor authentication, updates, one isolated copy of critical data, and one page with the incident response procedure.
How much should you spend on cybersecurity? Do not start from a percentage of the IT budget. Start from the cost of downtime: calculate what one day of stoppage costs (method here) and compare it with the cost of the measures that reduce this downtime.
We have outsourced information security. Are we protected? The contractor covers the technical half. Responsibility for the second half (the recovery plan, workarounds, communications) cannot be outsourced.
Is your team ready for the first hour of a crisis?
You test a plan by running a scenario. Reading it is not enough. The assessment shows the gaps, and the corporate format works through them with your team on your own processes.