Cybersecurity for small businesses in Morocco: 10 lessons from recent major attacks

CNSS, OFPPT, FortiBleed, Marks & Spencer, deepfakes: recent major cyberattacks share common causes. Here are ten practical measures, within reach of a Moroccan small business, to reduce the risk.

The cyberattacks that make headlines hit large organisations. But their causes are often simple: a stolen password, a login without two-factor authentication, a well-prepared phone call, a device that was not updated. Those causes apply to small businesses too.

The 10 lessons

• Turn on two-factor authentication for email, banking, your website and your VPN: Change Healthcare shows the cost of one forgotten login.
• Never reuse a password, and use a password manager.
• Update devices and software exposed to the internet, as the DGSSI’s FortiBleed alert reminded everyone.
• Limit permissions: each account reaches only what it needs, as the OFPPT leak shows.
• Confirm any change of bank details or unusual transfer by calling a known number.
• Be wary of imposed urgency and secrecy, including on video calls, as in the Arup case.
• Control contractors’ access and remove it when their work ends.
• Back up regularly, keep one isolated copy, and test restoring it.
• Plan a fallback: take orders by phone or WhatsApp if your site goes down.
• Know who to call: Morocco’s DGSSI and its maCERT team publish alerts and support organisations.

Where to start

If you do only one thing this week, turn on two-factor authentication for your work email and your website admin. Then check that your backups exist and actually restore.

And your website?

A website is also a way in: admin accounts, forms, plugins that were never updated. A well-built site limits access, protects its forms against abuse, stays up to date and collects as little data as possible.

Most cyberattacks do not start with technical brilliance, but with an avoidable oversight.

Sources: DGSSI / maCERT, CNSS, OFPPT, and the incidents covered in this series.

Want a secure, up-to-date website that is easy to manage? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.