The 4 stages of a cyberattack and where an SME can stop it

More than you think. From LinkedIn they take names and roles; from the website, email addresses; from the news, suppliers; from job adverts, internal software. Add employee credentials leaked in breaches at other services. The result is a targeted attack: the message from the usual supplier, the call from the bank, the login attempt with the reused password. None of this leaves a visible trace.

The brake: strip credentials of their value and shrink the public surface. A different password for each service, stored in a password manager, makes other people's breaches useless. Fewer generic addresses published and a clear rule for requests made "on behalf of" someone leave less room for social engineering.

• Fraudulent email Credentials typed into a fake portal or an attachment that installs malware.
• Access open to the internet RDP, VPN or old portals protected only by a password.
• Known flaws A firewall with outdated firmware, an unpatched server, Windows 10 out of support.

The intrusion itself takes minutes.

The brake: MFA on all external access, so a stolen credential opens nothing; email filtering and a team trained to spot and report phishing; patches applied and a managed firewall that exposes only what is essential. Most attacks on SMEs should end here.

Once inside, the intruder wants three things: administrator accounts, a route to the servers and access to the backups. If the network is flat, if every user administers their own PC and if the admin password is the same on every machine, a few hours are enough. Next comes the antivirus switched off, accounts created to come back later and backups deleted or encrypted.

The brake:

• Segmented network VLANs separating workstations, servers and backups (segmentation guide).
• No local administrators Each person works with strictly the rights they need.
• Immutable, isolated backups Out of reach of any network account.
• Eyes on the network NOC and monitoring, 24/7 on the Premium 365 plan, to catch logins at odd hours, new accounts or anomalous traffic while they are still alerts.

This is the reasoning behind the four Zero Trust steps applied to SMEs.

The entry will never be fully closed: there is always a wrong click and a new vulnerability. Impact can no longer be prevented. It is during expansion that a segmented, monitored network with protected backups reduces a serious incident to one workstation to reinstall. Even so, it is the phase companies neglect most, they spend on the front door and on recovery and leave the inside without partitions.

Contain it. The damage shows up as encrypted files with a ransom note, data exposed or sold, fraudulent transfers or services down. The attacker picks the time (Friday night, the eve of a bank holiday) to buy time. From then on you pay in days of downtime, recovery consultants, notifications to the CNPD and to clients, and reputation.

Containment: a written, rehearsed response plan (who switches off what, who talks to whom); verified backups the attacker cannot reach, the difference between restoring in hours and negotiating with criminals; disaster recovery with defined recovery objectives; and the first hours handled with method, as described in the guide to data recovery straight after an incident.

A reconstruction drawn from several SME incidents.

1. Tuesday: a "supplier invoice" reaches the accounts team; the employee enters her credentials in a fake portal.
2. That night: the attacker opens the mailbox and watches for a week. They find remote desktop access without a second factor.
3. Days later: now on the network, they exploit the fact that the user is a local administrator, harvest credentials and reach the file server and the backup NAS, on the same segment.
4. Thursday night: they delete the backups.
5. Early Saturday morning: they encrypt all the data. The company only notices on Monday.

A second factor on remote access would have stopped everything in phase 2. VLANs and isolated backups would have left only one server to restore. Without any of these measures, the bill was three weeks at half speed.

We analyse your infrastructure phase by phase and deliver, in writing, the point at which an attack would be stopped today and what is missing to stop it earlier. Find out more about DataRoad's managed cybersecurity: in 11 years, DataRoad has never recorded a security incident. No-commitment proposal.

More than 10 workstations · support contract · remote, on-site and telephone support.

Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.