The 3-2-1 backup rule: how to survive ransomware and hardware failure
Most companies have backups — until the day they need to restore. Here is a simple, proven model that keeps your data recoverable.
Read articleAttackers rarely target a company because it is famous. They target it because it is easy: an unpatched VPN, a reused password, an open remote desktop port. The good news is that a small set of well-implemented measures blocks the vast majority of real-world attacks.
The checklist
- Multi-factor authentication (MFA) everywhere. Email, VPN, remote access, cloud services and admin accounts. This single step stops most account takeovers.
- Timely updates. Operating systems, firewalls, VPN gateways and business applications. Internet-facing systems should be patched first.
- No exposed remote desktop. Never publish RDP or admin panels directly to the internet — use a VPN or a bastion host with MFA.
- Separate admin accounts and least privilege. Users work without admin rights; administrators use dedicated accounts only for administration.
- Backups following the 3-2-1 rule with one immutable copy and regular restore tests.
- A properly configured firewall and network segmentation. Servers, users, guests, cameras and IP phones belong in separate segments.
- Email protection. SPF, DKIM and DMARC for your domain, plus filtering of malicious attachments and links.
- Endpoint protection on every workstation and server, managed centrally.
- Central logging and monitoring. If nobody sees the alerts, an attack can continue for weeks unnoticed.
- An incident response plan and trained staff. Everyone should know how to recognize phishing and whom to call when something looks wrong.
Where to start
If you can only do three things this month, enable MFA, close any remote access exposed to the internet and verify that your backups can actually be restored. Then work through the rest of the list step by step.
Security is not a product you buy once — it is a process of small, consistent improvements.
CySec can assess your current infrastructure against this checklist and deliver a prioritized action plan — from quick wins to a long-term security roadmap.