7 Actionable Measures to Protect Your SME from Cyberattacks

Approx. 3500 – this is the number of companies that reported a cybersecurity incident to the National Cyber Security Centre (NCSC) in the first six months of 2024. In particular SMEs that account for 99.7% of companies in Switzerland underestimate the consequences of an attack. This can be fatal, and even jeopardize the company’s existence.  

What can you do if, as an SME, you lack the resources or knowledge to prepare for phishing, ransomware and the like? And where should you start? 

The good new is: By implementing 7 key measures and the zero trust approach to complement your cyber risk-aware culture, you will achieve a high level of security. Below, we will present these measures and explain how exactly zero trust can help you protect your SME against cyberattacks.  

Why is zero trust the solution of choice?

With the zero-trust approach, trust is not granted to devices or users by default. Instead, zero trust continuously monitors every action and every access based on a dynamic security assessment. In other words: it verifies in real-time whether security guidelines are complied with. This results in a more resilient security environment and lower risks through potential threats. The goal of the zero trust approach is to control and protect the IT environment in the best possible way.  

Here come our 7 most actionable measures that help you lay the foundations for a secure IT environment:

7 measures to enhance the cybersecurity of your SME by means of zero trust 

1. Using strong authentication

   

   Protect your accounts and systems by implementing strong authentication measures: 

   • Create complex passwords consisting of a combination of upper- and lowercase letters, numbers, and special characters. 
   • Enable multi-factor authentication (MFA) whenever possible to add another security layer. 
   • Use a reliable password manager to generate and securely store unique passwords. 
     
     

   The benefit of zero trust

   Zero trust verifies user identities continuously and contextually, e.g., based on their location or behavior patterns. By using strong authentication, it prevents unauthorized access. 

2. Keeping software up-to-date 

   Regular software updates are key in closing security gaps: 

   • Enable automatic updates to ensure prompt deployment of new software. 
   • Prioritize critical security patches to fix severe vulnerabilities first. 
   • Keep a record of all software versions used to efficiently manage updates. 
     
     

   The benefit of zero trust

   Continuous monitoring is a main characteristic of zero trust. This allows you to make sure that patches have been successfully deployed when updating software and that potential risks are mitigated. 

3. Collaborating with cybersecurity experts 

   

   Clearly assign responsibilities for cybersecurity in your company:

   • Hire a dedicated cybersecurity expert who monitors security measures. 
   • Use external cybersecurity services if hiring an expert is not possible. 
     
     

   The benefit of zero trust

   If you don't want to expand your team, cybersecurity experts who are familiar with security strategies such as zero trust will be happy to help you implement such a solution. 

4. Exercising caution with e-mails and links 

   Be careful when dealing with e-mails and online content: 

   • Do not open any suspicious e-mails, in particular if the sender is unknown. 
   • Verify links before clicking by hovering the mouse over them to see the target URL. 
   • Beware of potential phishing attacks requesting sensitive information. 
     
     

   The benefit of zero trust

   Zero trust provides strong e-mail security features such as encryption and phishing protection, allowing you to quickly secure communication. 

5. Using security software 

   

   Protect your devices and networks with solid security solutions: 

   • Deploy renowned antivirus and anti-malware software to fend off threats. 
   • Implement firewalls to monitor and control both in- and outbound network traffic. 
   • Consider using a virtual private network (VPN) for encrypted connections, in particular in public networks. 
     
     

   The benefit of zero trust 

   By continuously monitoring security and anticipating as well as mitigating risks, zero trust adds to the impact of security software that only responds when an incident occurs.

6. Securing data 

   Proactively seize measures to protect sensitive information: 

   • Encrypt important data at rest and in transit. 
   • Create regular backups of critical data and test recovery processes to avoid data loss. 
   • Minimize the personal information you disclose online to keep your exposure as low as possible. 
     
     

   The benefit of zero trust

   Securing data is a goal all three zero trust principles: «always verify explicitly» takes into account the sensitivity of data when it is accessed. «Use least privilege» makes communication more secure, and the continuous real-time analysis, which is part of the principle «assume breach», allows to identify and respond to anomalous activities. 

7. Implementing access controls

   Limit access to sensitive systems and data: 

   • Apply the «least privilege» principle, granting users only the access rights they need. 
   • Regularly review and update access rights to reflect current roles and responsibilities. 
   • Disable unnecessary connections such as bluetooth when not needed to minimize potential entry points. 
     
     

   The benefit of zero trust 

   The impact of this measure can be enhanced through the zero trust principles «always verify explicitly» and «use least privilege». Preventing unauthorized access allows you to strengthen overall security. 

Implementing zero trust – no, yes, how?

The benefits zero trust offers for cybersecurity are compelling. Logically, the next step would be to implement this solution. Too complicated?

If as an SME you do not have the human resources or necessary knowledge, you may be interested in an all-round carefree package.

Our managed cybesecurity services cover all measures required to provide your SME with the best possible protection against cyberattacks: from software updates, e-mail security, access control, and data protection strategies to tailor-made security solutions.