A collaborator clicks on a fake password reset link on a Friday at 5 PM. By Monday morning, the file server is encrypted by ransomware, the email system is down, and no one knows if the last backup works.
This scenario affects companies of all sizes, and the response goes beyond just installing antivirus software. Strengthening your company’s digital security in 2024 involves specific technical choices, tested organization, and real discipline regarding access.
Passkeys and phishing-resistant authentication
Phishing remains the primary entry vector for significant attacks against French companies. Campaigns are no longer limited to emails: SMS, voice calls, and fake mobile login portals multiply exposure surfaces. In light of this, the simple username-password combination is no longer sufficient, even with a second factor via SMS.
Passkeys change the game. Based on asymmetric cryptography, they eliminate the transferable password and render classic phishing ineffective. There are two categories based on the level of assurance sought.
- Synchronized passkeys replicate across devices within the same ecosystem (Apple, Google, password manager). Convenient for everyday use, they are suitable for standard business applications.
- Device-bound passkeys remain stored on a hardware token or an integrated security module. They offer a higher level of assurance for critical access: administration consoles, VPNs, sensitive databases.
- The choice between the two depends on the risk associated with each resource. Mixing both within the same organization is not only possible but recommended.
On the deployment side, we start with privileged accounts (system administrators, financial managers) and then gradually expand. Feedback varies on the ease of adoption depending on age groups and digital habits, but the learning curve remains short as long as there is internal support.
To delve deeper into the issues of information system protection, the resources available on the security section of Open Syd help to better understand the solutions suited for SMEs.
Logging and evidence: what authorities expect after an incident
Many companies invest in prevention and completely neglect traceability. French authorities, led by the CNIL, now emphasize the combination of MFA, logging, and control of remote access as the foundation of evidence in case of an incident. Without these elements, a company that falls victim to a cyberattack risks not only operational damage but also penalties for failing to implement appropriate security measures.
In practical terms, logging means recording connections, failed access attempts, changes in rights, and transfers of large files. These logs must be timestamped, retained for a duration consistent with regulations, and stored in a space separate from the monitored system.
Implementing usable logging
A connection log that generates thousands of lines without being readable is of no use. First, we define the events to capture: authentications, privilege escalations, access to personal data. Then we configure alerts for abnormal behaviors (connection from an unusual country, access at 3 AM on a workstation normally used during the day).
The sizing of storage and the retention period depend on the sector and the volume of data processed. Centralizing logs on a dedicated server or an outsourced service prevents an attacker from erasing their tracks by compromising the target machine.
Tested backups and incident response plan
The majority of companies claim to perform backups. Very few regularly test restoration. The difference between the two is measured on the day a ransomware encrypts the main server.
The CNIL explicitly recommends backups stored off the company’s network, with periodic restoration tests. An external hard drive permanently connected to the server is not a usable backup: it will be encrypted along with everything else.
Organizing the response before the crisis
An incident response plan should not be written during the attack. A reflex sheet covering four questions should be prepared in advance.
- Who makes the decision to isolate a server or cut off a VPN access? The decision chain must be clear, even in the absence of the leader.
- How do we communicate if the email system is compromised? A backup channel (encrypted messaging on personal phone, emergency phone number) must be defined.
- Which service providers to call and in what order? Hosting provider, business software vendor, cyber insurer, authorities (ANSSI for the relevant operators, CNIL if personal data is exposed).
- Where are the backups located and who has the credentials to access them? This point seems trivial until the only informed person is on leave.
Remote access management and network segmentation
Remote work has multiplied entry points to information systems. A poorly configured VPN or an open RDP access on the Internet represents a direct entry point for an attacker who has obtained credentials through phishing.
Every remote access must go through an encrypted tunnel with active multi-factor authentication. Generic accesses shared among multiple people (a single “admin” account for the entire team) should be avoided: they render logging useless since actions can no longer be attributed to an individual.
Segmenting to limit propagation
On a flat network, a compromised workstation gives access to all resources. Segmenting the network into zones (workstations, business servers, backups, IoT devices) limits the lateral propagation of an attack. Firewall rules are applied between each segment to allow only strictly necessary traffic.
This approach aligns with the principles of the zero trust model: no device or user is considered trustworthy by default, even within the network. Trust is verified with each request, not just once at the time of the VPN connection.
The European regulatory framework has recently tightened regarding incidents and the resilience of digital products. Waiting for the next attack to structure your digital security is like taking out insurance after the fire. The measures described here do not require a considerable budget, but they demand time, rigor, and especially regular testing to ensure they work on the day they are needed.
