With cyberattacks intensifying, information system security can no longer be approached solely from the perspective of tools. It is practices, processes, and operational rigor that make it possible to build a genuine defensive posture.

Here are 7 key recommendations to implement in any professional environment, from SMBs to multi-site groups, to raise the level of security without excessive complexity.

1. Prefer passphrases to complex passwords

Passwords that are too short or made up of random special characters are hard to remember, which often leads to risky behavior (unsecured storage, reuse across several accounts). Using long, understandable, and personalized passphrases improves security while remaining easy to use.

For example: JeSauvegardeMesDonnéesAvecKiwiEn2025! is far more robust and memorable than R#8d!xz2.

Adding multi-factor authentication (MFA) to critical access considerably strengthens this first layer of protection.

2. Use a secure password manager

Many organizations still store their credentials in office or shared documents without encryption. A password management solution centralizes access in an encrypted vault, with strong authentication at the entrance. This reduces human error while making access control easier across the company.

For environments subject to regulatory requirements, a local manager is often recommended. Organizations with remote workers or multiple sites will prefer certified cloud solutions with end-to-end encryption.

3. Secure connections via VPN and limit the use of public Wi-Fi

Connections from unsecured public networks expose you to interception attacks. When traveling or working remotely, it is strongly advised to connect through a professional VPN to encrypt data exchanges.

Even for occasional use, it is best to avoid any interaction with sensitive data on public Wi-Fi, unless a VPN is active. This includes access to business email, shared files, and business tools.

4. Implement a real backup strategy using the 3-2-1 method

In the event of a ransomware attack or technical failure, the ability to restore data quickly and completely is critical.

The 3-2-1 method remains a reliable benchmark:

  • Three copies of the data (production + two backup copies
  • Two types of media (for example, NAS / local disk + cloud
  • One offsite copy, off-site or isolated from the main network

Regularly testing restores is essential to make sure the backup strategy is truly operational.

5. Industrialize and prioritize security updates

Unpatched vulnerabilities are one of the most exploited attack vectors. Proactively updating systems, applications, and third-party components (browser, plugins, open source libraries) is an essential defensive measure.

In complex environments, it makes sense to prioritize the critical vulnerabilities identified in CVE databases and to deploy vulnerability analysis tools to track gaps over time.

6. Precisely identify sensitive data and control access

Many companies do not know exactly what data they host, where it is stored, or who has access to it. This can lead to accidental leaks, particularly through misconfigured AI or collaboration tools.

Implementing data classification and an access policy based on the principle of least privilege is essential. Regular reviews of rights, including on collaborative spaces (SharePoint, Google Drive, OneDrive, etc.), help limit the risk of unintentional compromise.

7. Formalize an incident response plan

Despite all precautions, a security incident can occur. It is therefore essential to have a clear, documented response plan.

This plan must include:

  • A defined chain of decision-making,
  • Alternative means of communication in case of unavailability (email, servers),
  • A rapid restoration process from backups,
  • A notification protocol in the event of a data breach (particularly under the GDPR)

Integrating an advanced detection solution — such as an XDR platform, which centralizes incident response using artificial intelligence, or a SIEM system, which aggregates and analyzes data from the IT environment to identify stealthy threats — makes it possible to gain visibility into the origin and scope of attacks, making corrective actions and compliance with reporting obligations easier.

Conclusion

Cybersecurity does not rely on technology alone. It also depends heavily on daily practices and simple measures, implemented rigorously.

Backup is one of these pillars. It should not be thought of as a secondary task, but as a key element of business continuity.

With Kiwi Backup, companies have a professional, reliable backup solution that complies with the highest security standards. It is a concrete answer to the challenges of resilience, data protection, and regulatory compliance.

Investing in an automated and secure backup solution is today one of the most effective ways to minimize the impact of an attack and ensure the resilience of your IT infrastructure.