João Mota
CTO | CMO
What needs to change upon our return
September marks the return to routine. Teams are heading back to work, resuming projects, answering piled-up emails and looking to get back into the swing of things after the holidays.
But there is one aspect that many companies continue to put on the back burner: cybersecurity.
The truth is that the post-holiday period is one of the most favourable times to review processes, correct flaws and implement best practices. After all, if we take advantage of the return to work to set objectives, reorganise teams and plan the coming months, why not do the same with IT security?
At Quantinfor, we regularly carry out cybersecurity audits and assessments for SMEs across different sectors of activity. Despite the differences between companies, there are mistakes that crop up time and time again.
1. Updates delayed for too long
It is common to find computers, servers and network equipment with pending updates for weeks or even months.
In many cases, these updates have been postponed to avoid work interruptions. The problem is that every delayed update can represent a known vulnerability exploited by cybercriminals.
The back-to-work period is an excellent time to confirm that all systems are up to date and protected.
2. User accounts that should no longer exist
Employees who have changed roles, left the company or no longer require certain access rights often continue to maintain active accounts.
These accounts represent an unnecessary risk and could be exploited if credentials are compromised.
September is a good time to review permissions and ensure that each user has only the essential access rights.
3. Weak or reused passwords
Despite all the existing awareness, it remains common to find simple passwords or ones used across multiple platforms.
A single compromised credential can open the door to multiple company systems.
Whenever possible, implement strong passwords and enable multi-factor authentication (MFA).
4. Backups that exist… but have never been tested
“We have backups.”
This is probably one of the phrases we hear the most.
The next question usually is: “When was the last time you tested the recovery of these backups?”
The silence that follows speaks volumes.
A backup only truly protects a company when the information can be recovered quickly and with complete integrity.
5. Network-connected equipment without any monitoring
Old computers, printers, NAS drives, Wi-Fi access points or other devices remain switched on for years without any monitoring.
Every forgotten piece of equipment is a potential gateway for an attack.
Having visibility over everything connected to the infrastructure is one of the first steps to reduce risks.
6. Lack of staff training
Technology evolves, but so do attacks.
Currently, many cyberattacks begin with a simple phishing email or a seemingly legitimate message.
Without continuous training, any employee can inadvertently become the organisation's most vulnerable link.
Investing in staff awareness continues to be one of the measures with the highest return in the area of cybersecurity.
Cybersecurity is like maintaining a tractor
In the agricultural sector there is a simple rule: nobody waits for a tractor to break down in the middle of the harvest to decide to do the maintenance.
Servicing is carried out in advance because an unexpected stoppage could compromise the entire production.
The exact same thing happens with IT infrastructure.
Waiting for an incident to happen in order to discover flaws is always more expensive, more time-consuming, and much more damaging to a company's business.
Prevention remains the best investment.
What should you do upon this return to work?
Make the most of the start of September to carry out a security review for your business.
Some actions can make all the difference:
- Confirm that all equipment is up to date.
- Review user access and permissions.
- Verify the operation of the backups.
- Check if multi-factor authentication is active.
- Update the incident response plan.
- Promote awareness-raising actions among employees.
- Assess the need for continuous infrastructure monitoring.
Minor improvements implemented today can prevent major problems in the coming months.
Start the new cycle with a better protected company
Just as we do a financial review or set new goals after the summer, cybersecurity also deserves a periodic review.
The companies that manage to prevent incidents are not necessarily the ones that invest most in technology. They are often the ones that maintain consistent processes, fix small flaws before they become major problems, and continuously monitor the state of their infrastructure.
Returning from holiday is the ideal opportunity to take that step.
👉 Want to know your company's security level? Schedule a chat with the João Mota and discover how an assessment can help identify risks before they impact your business.
