top of page

Top Tips to build resilience in the IT sector

The IT sector is commonly a target in cybercrime attacks.

Whether it is stealing code, sensitive data or using them as part of a supply chain attack, the IT sector need to be aware of and take action to build their own cyber resilience.

Man with VR googles on in front of a computer

And although tech companies are improving, and indeed leading the way in some areas of cyber security, sometimes the basics can be overlooked.

Top Tips

1. Enable 2FA. Many people still reuse passwords or use passwords that are weak. Password123! has a mixture of upper, lowercase, numbers and symbols but can be found on a criminal’s word list. Having 2FA should mean that even if a criminal got hold of usernames and passwords, they wouldn’t be able to log on. Admin accounts in particular need 2FA/MFA.

2. Segment customer data. This way if someone does gain access to one customer, they won’t immediately get access to everything.

3. Access control. Make sure that only people who need access to key systems have it. Does everyone in the company need access to your code repository? Do your admin accounts, only carry out admin activities? Consider the insider threat. When someone leaves the company, do you remove their access before or after they leave the building?

4. Train your staff. It doesn’t really matter if you have the best protection, you can buy if your staff are clicking on those phishing emails or letting anyone with a clipboard and a lanyard into your server room. Metacompliance found that 91% of cyber-attacks started with phishing, so if you are not preparing your staff to deal with this attack vector you are potentially making your business vulnerable.

5. Patch. Yes, patching can be problematic, yes, it is annoying, but yes, it does stop criminals from being able to exploit security weaknesses. And if you develop your own software, are you actively looking for your own weaknesses? Why not develop a vendor programme and get the good guys working for you rather than waiting for a bad one to find the needle in the haystack?

Further guidance & support

The Eastern Cyber Resilience Centre provides Staff Awareness Training, but did you know your local police protect officer might be able to do this too? We train and mentor local university students, so when we say affordable, it really is. Find out more here.

Our students also complete vulnerability assessments, maybe you could use us mid-development?

The Eastern Cyber Resilience Centre is a not-for-profit membership organisation, run by policing, with the intention of increasing cyber resilience of SMEs within the East of England.

You can contact the Cyber Resilience Centre for guidance and support through our e-mail or use our online booking system to make an appointment with one of our team


We also provide free guidance on our website and we would always encourage you to sign up for our free core membership. Core members receive regular updates which include the latest guidance, news, and security updates. Our core membership has been tailored for businesses and charities of all sizes who are based across the seven counties in the East of England.

Policing led – business focused.

The Eastern Cyber Resilience Centre logo


The contents of this website are provided for general information only and are not intended to replace specific professional advice relevant to your situation. The intention of The Cyber Resilience Centre for the East is to encourage cyber resilience by raising issues and disseminating information on the experiences and initiatives of others. Articles on the website cannot by their nature be comprehensive and may not reflect most recent legislation, practice, or application to your circumstances. The Cyber Resilience Centre for the East provides affordable services and Trusted Partners if you need specific support. For specific questions please contact us.

The Cyber Resilience Centre for the East does not accept any responsibility for any loss which may arise from reliance on information or materials published on this document. The Cyber Resilience Centre for the East is not responsible for the content of external internet sites that link to this site or which are linked from it.

bottom of page