Cybersecurity conversations have a habit of turning into
shopping lists.
You need better email security. Better endpoint protection.
Another monitoring platform. Maybe a new firewall.
Sometimes those investments are worthwhile. But before a
South Shore business spends money adding another layer, there are usually a few
simpler questions worth asking.
Is multi-factor authentication actually turned on everywhere
it should be? Are former employees still sitting in Microsoft 365? Who has
administrator access? Are computers updating properly? And when was the last
time anyone tried restoring something from the backup?
Those questions are not particularly glamorous, which may be
why they are so easy to overlook.
But for small and mid-sized businesses around Plymouth,
Marshfield, Weymouth, Braintree, and Greater Boston, tightening up the basics
can reduce a surprising amount of risk before another cybersecurity product
ever enters the conversation.
1. Turn on multi-factor authentication
If an important business account is still protected by only
a username and password, start there.
Multi-factor authentication, or MFA, requires another form
of verification before someone can sign in. Depending on the system, that might
be an authenticator app, security key, passkey, or biometric verification.
That additional step matters because passwords get stolen.
They are exposed through phishing, reused between accounts,
saved in unsafe places, or captured when someone signs into a convincing fake
website.
MFA makes a stolen password considerably less useful by
requiring the attacker to get past another layer.
Start with the accounts that would cause the most trouble if
compromised:
- Microsoft
365 or Google Workspace
- Banking
and financial systems
- Payroll
applications
- Cloud
storage
- Remote
access and VPN accounts
- Administrative
accounts
- Other
business-critical applications
For many organizations, MFA capabilities are already
included in services they are paying for. The first question may simply be
whether those protections have been properly enabled.
2. Remove accounts nobody needs anymore
Businesses are usually pretty good at creating accounts.
Removing them is another story.
An employee leaves. A contractor finishes a project. A
vendor no longer supports a system. Everyone moves on, but the login quietly
remains.
Over several years, those forgotten accounts accumulate.
For a growing Plymouth professional services firm or South
Shore construction company, this can happen surprisingly quickly, especially
when employees, outside vendors, and temporary staff all need access to
different systems.
Periodically review user accounts and ask:
- Does
this person still work with us?
- Does
this vendor still need access?
- Is the
account still being used?
- Does
it have more access than necessary?
Old accounts should be disabled when they are no longer
required, and access should be adjusted when someone's responsibilities change.
Security is easier when you know exactly who can get into
your systems.
3. Take another look at administrator access
Administrator privileges are useful.
They are also powerful.
An administrator may be able to install software, create
users, change security settings, access sensitive information, or disable
protections entirely.
That makes administrative accounts especially valuable to an
attacker.
The problem is that admin access often gets handed out for
convenience and then never reconsidered.
Someone needed to install a printer three years ago, so they
became a local administrator. A manager needed access to a setting once and
still has elevated permissions today.
Review who has administrator rights and ask whether they
genuinely need them for their normal job.
If they do not, reduce the access.
This follows a basic security principle: give people enough
access to do their work, but not considerably more.
4. Make sure devices and applications are actually
updating
Software updates are easy to postpone.
The notification appears in the middle of the day, someone
clicks "remind me later," and life continues.
Unfortunately, many updates contain fixes for known security
vulnerabilities.
Once those weaknesses become publicly known, attackers may
actively look for computers that have not been patched.
Enable automatic updates where practical for:
- Windows
and macOS computers
- Phones
and tablets
- Web
browsers
- Microsoft
Office and productivity applications
- Security
software
- Frequently
used business applications
This is especially important in businesses where employees
work from home, travel between locations, or use laptops that are not always
connected to the office network.
Turning automatic updates on is a good start.
The next step is having some way to confirm they are
actually happening.
5. Stop relying on employees to remember dozens of
passwords
Telling employees to create a unique, complicated password
for every account sounds reasonable.
Expecting them to remember all those passwords is not.
Without a better system, people tend to compensate. They
reuse passwords, make predictable variations, save credentials in browsers or
spreadsheets, or write them somewhere convenient.
A business password manager can make strong password habits
considerably more practical.
It can help employees:
- Create
unique passwords
- Store
credentials securely
- Avoid
password reuse
- Manage
shared credentials more carefully
- Keep
passwords out of spreadsheets, email, and sticky notes
The larger lesson is that good cybersecurity habits need to
be realistic.
If the secure way of doing something is dramatically harder
than the insecure way, employees will eventually find a shortcut.
6. Restore something from your backup
Almost every business we talk to has some form of backup.
The more important question is whether anybody knows it
works.
A dashboard saying "successful" tells you that a
backup job ran. It does not necessarily tell you how smoothly recovery will go
when a file server fails, ransomware encrypts data, or someone accidentally
deletes an important folder.
Test the recovery process.
Ask:
- What
information are we actually backing up?
- When
did the last successful backup complete?
- Is
Microsoft 365 or other cloud data included where appropriate?
- Has
anyone restored a file recently?
- How
long would it take to recover an important system?
- Who
would be responsible for starting that process?
That last point is easy to miss.
A backup is ultimately a recovery tool. The real test is not
whether data was copied somewhere. It is whether the business can get that data
back when it matters.
You may already own more security than you are using
There is an understandable tendency to look for the next
cybersecurity solution.
New products are visible. Configuration changes are not.
But some of the most useful security work happens in the
background: removing an old account, reducing unnecessary permissions, turning
on an existing feature, installing updates, or successfully restoring
yesterday's backup.
