Cyber security
Multifactor authentication, patching, backups, phishing awareness and email authentication, set up and checked for UAE small and medium businesses, with no inflated claims.
Most attacks on small businesses in Dubai are not clever. A reused password, a staff member who approves a fake sign in prompt, an invoice email from a lookalike domain, a laptop that missed months of updates. Our cyber security service for UAE companies focuses on the handful of controls that deal with those everyday threats, sets them up correctly, and checks that they stay in place.
It is part of our IT services. We are not a security operations centre, we do not hold security certifications, and we will say so plainly whenever it matters.
The controls
None of these needs a large budget. All of them need to be configured properly and reviewed, which is where most businesses slip.
Microsoft reports that multifactor authentication, combined with blocking legacy sign in protocols, stops more than 99.9% of the common identity attacks it sees. We enforce it for every user, starting with admins, and remove old protocols that bypass it.
Operating systems, browsers, office apps, routers and the plugins on your website. We check update status on a schedule and chase devices that fall behind, which is also why website maintenance matters for security.
At least one copy stored separately from the live system, so ransomware or an angry former employee cannot delete both. A backup only counts once a restore has been tried.
Short sessions using examples relevant to Dubai offices: fake courier and customs fees, supplier bank detail changes, and messages pretending to be a manager on WhatsApp.
SPF, DKIM and DMARC records that make your domain harder to spoof and help your real messages reach inboxes. Details below.
Separate admin accounts, as few of them as possible, and a record of who holds each one.
Email authentication
Invoice fraud usually arrives by email, and email authentication is how receiving servers tell your real messages from forgeries. SPF lists the servers allowed to send for your domain, DKIM signs messages so they can be verified, and DMARC tells receivers what to do when a message fails those checks and sends you reports about it.
Google’s sender guidelines made this more than good practice. Since 1 February 2024, anyone sending to Gmail accounts must set up SPF or DKIM, use TLS and keep spam rates below 0.3%. Senders of more than 5,000 messages a day must also have DMARC, with the From domain aligned to SPF or DKIM, and one click unsubscribe on marketing mail. Many UAE businesses discover these gaps when their quotes start landing in spam, a problem our email marketing team also sees on campaigns.
UAE context
This is orientation, not legal advice. We point you to the official sources and help you act on the technical side.
Federal Decree Law No. 45 of 2021 applies to the processing of personal data through electronic systems, inside or outside the country, according to the UAE Government portal. It sets obligations to secure personal data, restricts processing without consent except in defined cases, gives individuals rights to correction and to restrict processing, and sets requirements for cross border transfers. The portal also notes separate data protection rules in the DIFC under DIFC Law No. 5 of 2020. The same government page lists Federal Decree Law No. 34 of 2021 on Combatting Rumours and Cybercrimes as the framework for online crimes.
The Council’s website has a form for reporting cybersecurity incidents, and it lists channels for reporting cybercrime: the eCrime website of Dubai Police for Dubai, the Aman service of Abu Dhabi Police, and the Ministry of Interior’s eCrimes platform.
When something goes wrong
We help you prepare a one page response plan that staff can follow without waiting for anyone. It is a set of first steps, not an incident response service.
Reset the affected password, sign the account out everywhere, and disconnect a suspect device from the network.
Look for new mailbox rules, forwarding addresses and unfamiliar sign ins, which are common after an email account is taken over.
Tell clients and suppliers who may receive fraudulent messages, especially about payment changes.
Use the official UAE channels, and speak to your bank immediately if money has moved.
Recover from backup where needed, and close the gap that allowed it.
Limits
We would rather you hire the right specialist than believe we are something we are not.
| Included | Not included |
|---|---|
| Configuration of multifactor sign in, update policies, backup checks and email authentication | Accredited penetration testing or red team exercises |
| Phishing awareness sessions and a written response plan | A security operations centre, managed detection or monitoring around the clock |
| A documented baseline review, repeated periodically | ISO or other certification, legal advice, or promises about stopping every attack |
Security depends on day to day account administration too. See IT support for starters, leavers and devices, and cloud services for where your data is stored.
From the blog
Straight answers
No. We do not hold penetration testing accreditation, and we do not present configuration reviews as penetration tests. If a client, insurer or regulator asks for one, we can help you write a brief for an accredited specialist.
Security controls support compliance, but they are not legal advice and do not settle every obligation. Questions about consent, cross border transfers or whether a free zone law applies to you belong with a lawyer.
We help with the practical first steps inside the systems we manage, such as locking accounts, revoking sessions and restoring from backup. We do not run an incident response service and cannot promise an outcome, so serious incidents should also be reported to the authorities.
Short, regular sessions work better than one long annual course, and new starters should get it in their first week. We agree a frequency in the proposal that suits your team size.
No, and we will not imply otherwise. Our work is practical configuration and awareness for small businesses, documented so that an auditor or specialist can see exactly what was done.
Sources
Fixed price, in writing
Got it. Your quote is being written now.
In business hours you will have it within 45 minutes. Check your inbox for the confirmation.
