No single control saves you: layered security for Israeli SMBs

Ask a small business how it protects itself and you often get a single answer: we have a firewall, or we run antivirus, or our email is on Microsoft 365 so it must be fine. Each of those is a real control. None of them, on its own, keeps a business safe. Attackers do not test your strongest defense, they look for the one you forgot, and a setup that leans on a single product is usually one good lock on a house with several doors. Layered security, sometimes called defense in depth, is the opposite habit: instead of one wall you build several, each covering the places where the others are weak.

Why one strong control is never enough

Every security control has a failure mode. A firewall inspects traffic at the edge of your network, but it cannot help once an attacker is already signed in as one of your staff. Multi-factor authentication protects logins, yet it does nothing for a laptop that is already infected. Endpoint protection watches the device, but a brand-new attack can slip past it for a while. Backups will not stop a breach at all, they only let you recover from one. The point is not that any of these is weak. It is that each has a specific blind spot, and attackers make their living in blind spots. Layering works because the gap in one control sits behind the strength of another.

The layers, and the job each one does

It helps to name the layers and be honest about what each is for. Your firewall guards the network edge, decides what traffic is allowed in and out, and separates parts of your network from each other. Microsoft 365, hardened with multi-factor authentication and sensible policies, protects identity, which is now the main thing attackers go after. Endpoint protection, or EDR, watches each computer for behaviour that looks like an attack and can isolate a machine that turns hostile. Backups sit underneath all of it as the recovery layer, the one that assumes everything above it has failed. Monitoring gives you eyes on all of them, and your people, trained to pause on a suspicious message, are a layer too. A well-run FortiGate or Check Point firewall is one plank in that structure, not the structure itself.

Walk a real attack through the layers

Picture a common incident. An employee at a small law firm gets a convincing email and enters their Microsoft 365 password on a fake login page. That is the first layer beaten. If multi-factor authentication is enforced, the attacker has the password but still cannot get in, and the attack often ends there. Suppose MFA was missing, so they do sign in. Conditional Access, set to allow business data only from managed devices, can still block them. Suppose that is missing too, and they reach the mailbox and try to move deeper into the network. A segmented network and a properly configured firewall limit how far they can travel. If they land malware on a machine, endpoint protection can catch the behaviour and isolate it. And if every one of those layers somehow fails, tested backups mean the business recovers without paying a ransom. No layer had to be perfect. Each one was another chance to stop the attack.

Identity is the perimeter that matters most

For most small businesses the real front door is no longer the office network, it is the Microsoft 365 login. Staff sign in from home, from phones, from cafes, and a stolen password gives an attacker the same access the employee has, from anywhere in the world. That is why identity gets the most attention in a layered approach. Multi-factor authentication is the single highest-value control here, and it should apply to everyone, not only managers. Conditional Access, available in Microsoft 365 Business Premium and above, adds the ability to allow access only from known devices or to challenge risky sign-ins. Turning off legacy authentication protocols, which quietly bypass MFA, closes a common gap. None of this is exotic, and it blocks the large majority of account-takeover attempts.

The firewall still earns its place

Identity may be the new perimeter, but the network still matters, and the firewall is where you shape it. A business firewall does far more than the box an internet provider hands you: it inspects traffic, blocks known-malicious connections, filters web content, runs a VPN for remote staff, and lets you divide the network so a problem in one area cannot spread everywhere. That segmentation is what stops a single infected laptop from reaching the file server, the backups, and the accounting machine. Whether the device is a FortiGate or a Check Point matters less than whether someone keeps its firmware current, cleans up old rules, and actually turns on the protection features you paid for. A neglected firewall gives false comfort, which is worse than knowing you have a gap.

Endpoint protection catches what slips through

Some attacks will reach a device no matter how good your email filtering and network controls are. That is the job of endpoint protection. Traditional antivirus recognises known bad files, which is useful but no longer sufficient, because modern attacks are built to avoid being on that list. EDR shifts the focus to behaviour, watching for the pattern of an attack in progress, such as a process suddenly encrypting files, and it can isolate the affected machine within seconds. In a layered setup EDR is the catcher behind the plate: it assumes something got past the earlier defenses and is designed to stop it before it spreads. For most small businesses the version worth having is a managed one, where someone actually responds when it raises an alarm at three in the morning.

Backups assume everything else failed

Backups are the layer built on pessimism, and that is exactly why they are essential. Every other control is trying to prevent or contain a breach. Backups accept that one day something might get through anyway and make sure the business survives it. The details matter: a backup that is permanently connected to the network often gets encrypted along with everything else when ransomware strikes, so at least one copy must be isolated or immutable. And a backup you have never tested is a guess, not a safety net. The businesses that recover quickly from a serious incident are almost always the ones that could restore from a clean copy, not the ones with the cleverest prevention.

Monitoring is what ties the layers together

Layers only help if someone notices when one of them is breached. Monitoring is the connective tissue: it collects signals from the firewall, from Microsoft 365 sign-in logs, and from endpoint protection, and turns them into a picture of what is actually happening. A single failed login means nothing; hundreds from a foreign country against one account at two in the morning is a story. Most small businesses cannot staff a security team to watch these signals around the clock, which is why managed detection and response exists. The value is not only in catching an attack early, it is in being able to answer the questions that always follow an incident: how did they get in, what did they reach, and is it really over.

Your weakest layer sets your real risk

Here is the uncomfortable part of thinking in layers. Your security is not as strong as your best control, it is closer to your weakest one. A business with an excellent managed firewall but no MFA on Microsoft 365 has left the main door unlocked. A business with EDR on every laptop but backups that were never tested is one bad day from a very long week. The practical lesson is to resist the urge to keep improving the layer you already understand and instead ask where the obvious gap is. Usually it is not the exotic threat that gets a small business, it is the ordinary control that was never turned on. Spreading effort across the layers beats perfecting one of them.

Where NetFortress fits

Layered security sounds like a lot, and for a business without in-house IT it can be hard to know whether the layers are actually there or just assumed. That is the work NetFortress does for Israeli SMBs: hardening Microsoft 365 so identity is genuinely protected, designing and managing firewalls on both FortiGate and Check Point, deploying endpoint protection that someone monitors, and making sure backups exist, are isolated, and have been tested. If you are not sure which of your layers are solid and which are only on paper, ask us for a review and we will show you plainly where an attacker would find the easiest way through.