The 9 Security Layers We Expect a Small Business to Have
Good small-business security is not one product. It is a set of controls that overlap so one missed click, stolen password or vulnerable device does not automatically become a major incident.
At ITstuffed we describe the baseline as seven protection layers plus two recovery layers. The exact products can change; the functions should not.
The seven protection layers
1. People and awareness
Staff know how to recognise common scams, unexpected MFA prompts and suspicious behaviour, and they have a simple way to report concerns.
2. Identity and access
MFA, sensible Conditional Access, privileged-account protection and controlled user lifecycle reduce the chance that a stolen credential becomes unrestricted access.
3. Email and collaboration security
Business email needs filtering and malicious-link/attachment protection, with a clear process for handling suspicious releases and impersonation attempts.
4. Endpoint protection
Managed computers need modern endpoint protection, detection capability and security configuration rather than standalone consumer antivirus.
5. Patch and vulnerability management
Operating systems and applications need timely updates, and known weaknesses need to be identified rather than waiting for somebody to exploit them.
6. Web and DNS protection
Blocking access to known malicious destinations adds another barrier when a user or application tries to reach dangerous infrastructure.
7. Monitoring and response
Security alerts need somebody to review and respond to them. A tool generating notifications at 2am is not the same as a monitored security service.
The two recovery layers
8. Backup
Important systems and cloud data need protected copies that are appropriate to the business's recovery needs.
9. Recovery testing
A green backup status is not proof that recovery will work. Restores should be tested so the organisation knows its data can actually be recovered when required.
Why the layers matter
No layer is perfect. Staff can be tricked. MFA can be bypassed in some attack scenarios. Endpoint software can miss something. A vulnerability can appear between patch cycles. Layering means the next control still has a chance to stop or limit the incident.
You can use our free IT Security Self-Check to see how your own setup compares. For the managed-service implementation, see our cyber-security service and Technology Platform.