10 security measures every small and mid-sized business should have
You don't need an enterprise budget to be much harder to attack. Start with these ten measures — most of them cost very little.
Read articleFor many businesses 1C:Enterprise is the heart of daily work: accounting, payroll, sales, warehouse and reporting to the tax authorities. That also makes it one of the most attractive targets for attackers and one of the most painful systems to lose. Yet 1C is often installed once and then left without regular care.
The most common risks
- Web client or RDP open to the internet with weak or shared passwords.
- Users without passwords or one common login for the whole accounting department.
- File-mode databases on a shared folder that every employee can read, copy or encrypt by accident.
- Backups stored on the same server — they disappear together with the database during a ransomware attack.
- Outdated platform and configuration that no longer receive fixes.
Access control
- Give every employee a personal 1C account with a strong password and only the roles they actually need.
- Remove accounts of former employees the same day they leave.
- Do not publish 1C directly to the internet. Use a VPN with MFA, or at least restrict the web client to known IP addresses.
- Keep administrator rights for a very small number of people.
Backups that really restore
Use the 3-2-1 rule: regular database dumps plus file-level copies, at least one copy outside the office and one copy that cannot be changed or deleted. For client-server installations, back up the SQL database with its own tools on a schedule. Most importantly, restore a copy to a test server from time to time and check that the reports open.
Updates and monitoring
Plan regular updates of the 1C platform, the configuration and the operating system, and test them on a copy first. Log who logs in and when, and watch for unusual activity such as mass data exports or logins at night.
Your 1C database is your company's memory. Protect it like the most valuable asset you have.
CySec helps companies secure 1C: we review access rights, set up VPN and MFA, build automated and tested backups and monitor the servers 24/7.
Frequently asked questions
Is it safe to publish the 1C web client to the internet?
Only with strong protection: HTTPS, personal accounts with strong passwords, ideally MFA or a VPN in front, and up-to-date platform and web server. The safest option is access through VPN only.
File mode or client-server — which is safer?
Client-server with a database server (PostgreSQL or MS SQL) allows better access control, backups and performance. File mode on a shared folder is easier to copy or encrypt by mistake or by malware.
How often should a 1C database be backed up?
At least daily, and for busy accounting and trade databases several times a day. Keep copies outside the 1C server and test restores regularly.
What should we do when an employee leaves?
Disable their 1C account the same day, along with VPN and email, and change any shared passwords they knew.