Cybersecurity Basics Every Company in Bangladesh Should Implement Immediately

Why Cybersecurity Is Critical for Bangladeshi Companies

Bangladesh is experiencing rapid digital transformation. Businesses across every sector are now using tools that create digital vulnerabilities if left unprotected.

Common digital tools increasing exposure:

• ERP systems with sensitive business and financial data
• Cloud storage platforms (Google Drive, OneDrive, Dropbox)
• Email communication for contracts, payments, and buyer correspondence
• Remote access tools for hybrid and work-from-home staff
• Online banking and financial transaction platforms

Most common security gaps seen in Bangladesh businesses:

1 Strong Password Policy & Multi-Factor Authentication

Weak passwords remain one of the biggest and most preventable cybersecurity risks. Many employees in Bangladesh still use passwords that take seconds to crack.

Common weak passwords still widely used:

• 12345 — simple numeric sequence
• company123 — predictable company name format
• admin / password — default credentials never changed

What every company should implement:

• Minimum 12-character password policy (uppercase + lowercase + numbers + symbols)
• Mandatory password change every 60–90 days for all accounts
• Strictly prohibit sharing passwords between employees — documented policy
• Use a password manager (Bitwarden, LastPass) for secure team credential storage
• Enable Multi-Factor Authentication (MFA) on all critical systems: email, ERP, banking

2 Employee Cybersecurity Awareness Training

Technology alone cannot protect a company. In Bangladesh, the most common cyber attacks happen through phishing emails and malicious links — not through hacking sophisticated systems. The human layer is the weakest link.

A real example: An employee receives an email pretending to be from their bank or a key buyer, clicks a link, and unknowingly provides their login credentials to an attacker. The attacker then accesses company email, financial systems, or ERP data.

What companies should implement:

• Conduct quarterly basic cybersecurity awareness training for all staff
• Teach employees how to identify phishing emails — check sender address, avoid urgent payment requests
• Create a simple one-page IT Security Guideline in Bengali for factory/floor-level staff
• Establish a clear process for reporting suspicious emails or links without fear of blame
• Designate cybersecurity champions in each department for peer guidance

3 Regular Data Backup Strategy (3-2-1 Rule)

Many businesses only realize the importance of backups after catastrophic data loss. System crashes, ransomware attacks, accidental deletion, and hardware failure can permanently destroy critical business data.

Critical business data that must be protected:

• ERP database — orders, production, inventory, accounts
• Financial reports and accounting records
• HR and payroll records
• Client information, buyer contracts, and correspondence

The 3-2-1 Backup Rule — implement this today:

• 3 copies of all critical data at all times
• 2 different storage types — e.g., local server AND external drive
• 1 offsite or cloud backup — separate from your office location

4 Software Updates & Security Patches

Using outdated software is one of the most avoidable cybersecurity vulnerabilities. Attackers actively scan for systems running known unpatched versions of Windows, Office, browsers, and ERP systems.

In Bangladesh, the widespread use of pirated or unlicensed software creates an especially dangerous situation — pirated software cannot receive security updates and may contain built-in malware.

Essential patching practices:

• Enable automatic updates for Windows and all operating systems
• Keep antivirus and endpoint protection software updated daily
• Ensure ERP system receives vendor security patches on schedule
• Replace all pirated software with licensed alternatives — prioritize critical systems first
• Maintain a software asset inventory — know what is running on every machine

5 Access Control & Role-Based Permissions (RBAC)

Not every employee should have access to all company data. A proper access control system ensures that people can only access the information necessary for their specific role. This limits the damage from both insider threats and external account compromises.

Role-Based Access Control (RBAC) in practice:

• Accounts team — access to financial systems and reports only
• HR team — access to employee records, not production or financial data
• Production staff — access to operational data and WIP only
• Senior management — read-only dashboard access to all modules
• Disable accounts immediately when employees resign or are terminated
• Quarterly access audit — review who has access to what and remove unnecessary permissions

6 Network Security & Firewall Protection

Many companies in Bangladesh operate networks with open WiFi, no firewall configuration, and no segmentation — essentially leaving the door open for anyone inside or outside the building to access all systems.

Core network security controls:

• Deploy and properly configure a hardware firewall at the network perimeter
• Separate WiFi networks: one for staff, one for guests — never share the same network
• Segment sensitive systems (ERP server, finance server) from general office network
• Require VPN for all remote access to company systems
• Change all router and network device default passwords immediately
• Review network access logs monthly for unusual connection attempts

7 Incident Response Planning

Cyber incidents can happen to any organization, regardless of size or industry. The critical question is not "if" a security incident will occur — it is "when" and "how prepared will you be?"

Without a documented plan, organizations in Bangladesh typically take days or weeks to recover from incidents that well-prepared organizations resolve in hours.

Your incident response plan must include:

• Clear and simple process for any staff member to report a suspected security incident
• Named team responsible for investigating and managing incidents (IT + Management)
• Step-by-step procedures to isolate affected systems and prevent spread
• Data recovery and system restoration procedures (linked to your backup strategy)
• Communication plan — who to notify internally and externally (buyers, partners)
• Post-incident review process — document lessons learned and update defenses

8 The Role of IT Leadership in Cybersecurity

Cybersecurity is not purely a technical issue — it is a management responsibility. In Bangladesh's corporate and manufacturing sectors, IT and MIS departments must evolve from reactive support functions into proactive strategic security partners.

What IT & MIS leaders should do:

• Present cyber risk reports to senior management quarterly — in business language, not technical jargon
• Develop and enforce practical IT security policies across all departments
• Continuously monitor systems for anomalies, unauthorized access, and unusual activity
• Align cybersecurity investment with actual business risk — prioritize highest-impact controls first
• Build security awareness into company onboarding for all new employees