The threats that matter
In an SME in Morocco, the danger rarely comes from a targeted attack: most attacks are looking for an open door.
- Ransomware It encrypts files, sometimes spreading to the server and the NAS, and then a ransom is demanded.
- Phishing A fake email from a supplier, a bank or Microsoft tries to obtain a password or get someone to open an attachment.
- Forgotten access A former employee's account, a shared password, remote access left open for a contractor.
- Failure or error A failing disk, an overwritten file or a stolen laptop is enough to lose data.
SADIS, a Moroccan company with its registered office in Laâyoune and an operational office in Casablanca, secures what it already installs: the network and infrastructure, Microsoft 365, workstations and management software.
Audit and vulnerability assessment
The IT security audit takes an inventory of workstations, servers, accounts, data and access rights, then checks backups, the firewall, administrator accounts, email, updates and remote access.
The vulnerability assessment covers exposed websites, the network and systems. Each finding is given an action ranked by priority, with exploitable flaws first.
The audit also reviews where you stand with Law 09-08, which requires the protection of the personal data of customers, employees and suppliers, under the oversight of the CNDP. DGSSI recommendations serve as a reference. The team holds ISO/IEC 27001 Implementer competence, obtained from Bureau Veritas: it supports the set-up of an information security management system (ISMS), from risk assessment to the Statement of Applicability. We help apply these rules, without issuing any certification or accreditation.
Accounts and access
Most incidents start with an account that has been stolen, guessed or reused. This is the first area to address.
- Multi-factor authentication (MFA) A confirmation on a phone protects the Microsoft 365 account, even if the password has leaked.
- Named accounts A shared account makes it impossible to know who did what.
- Least privilege Everyone accesses only what they need, without administrator rights on their workstation.
- Departures handled the same day Email, files, software and remote access are cut off.
Case study
During a Microsoft 365 migration for Valdeme Maroc, the Moroccan subsidiary of a French industrial group, we unified the on-premises directory and the cloud with Microsoft Entra Connect: a departure is handled in a single operation, email included. The details are in the case study of this industrial subsidiary.
Securing firewalls and VPNs
In many SMEs, the internet provider's router serves as the firewall, with its factory settings. We install a next-generation firewall (Fortinet, Sophos or pfSense, depending on what is already in place) that filters traffic by application, inspects it and logs events.
Remote access and links between sites go through IPsec or WireGuard VPNs with MFA, never through ports open to the Internet. Guest Wi-Fi and business video surveillance cameras stay separate from the file server. Hardening completes the setup: unnecessary services disabled, default passwords changed, administration restricted to dedicated accounts.
Workstations, EDR and monitoring
Updates are tracked everywhere: workstations, servers, the firewall, the NAS and the Wi-Fi access points. An EDR detects suspicious behaviour, such as mass file encryption, and isolates the affected workstation. Laptops are encrypted, so that a theft does not become a data leak. The antivirus and EDR page (in French) explains where an EDR is justified and where a centrally managed antivirus is enough.
Monitoring relies on Zabbix for equipment status and on Wazuh for security events: a full disk, a failed backup or an unusual sign-in triggers a centralised alert. Day-to-day follow-up falls under IT fleet maintenance.
Cloud backup and business recovery
The 3-2-1 rule is the starting point: three copies, on two different media, one of them off site.
We set up a hybrid cloud architecture: a local NAS for fast restores and a cloud backup, with Veeam for example, out of reach of ransomware. Microsoft 365 mailboxes, the sales management database and files left on workstations are also backed up. Scheduled restore tests, on real files and servers, are followed by a written report.
The disaster recovery plan (DRP) specifies what to restore, in what order and by whom. How it is prepared is described on the cloud backup and recovery plan (in French) page (in French).
- Isolate Disconnect the affected workstations from the network.
- Alert Notify the right people, with contact details kept off the server.
- Assess Establish what is affected and what is not.
- Restore In the agreed order: management software, email, files, then the rest.
- Fix Close the entry point and document the incident.
Training teams
No tool can stop a user who types their password into a fake page. Awareness training teaches people to recognise phishing, to verify by phone any change of bank details and, above all, to raise the alarm right away. A click reported within a minute is easy to handle; hidden for a week, it becomes an incident.
Your access stays yours
Configurations are documented and administrator accounts belong to your company. The founders spent six years on freelance assignments within large French industrial groups before founding SADIS in Morocco. A free audit of your existing setup comes before any quote.
