Cybersecurity

Small businesses rarely get attacked because someone singled them out. They get attacked because a password turned up in a breach list, or an email account had no second factor, and a script found it. The damage is rarely dramatic either. It is a week of downtime, an invoice paid into the wrong account, and customers who now know it happened.

The controls that actually prevent this are well understood and unglamorous: multi-factor authentication on anything that touches company data, real endpoint protection on every machine rather than the antivirus that came with it, backups that cannot be encrypted along with everything else, and a written plan for the first hour. Most small offices we meet are missing at least two of the four.

What we put in place

• Multi-factor authentication across email, VPN, remote desktop, banking, and every administrator account

• Managed endpoint detection and response on every device, monitored rather than merely installed

• Immutable backups with restore tests, and the test dates written down

• A written incident response plan that names who calls whom in the first hour

• Phishing simulation and short training your staff will actually sit through

What it is worth

When a customer sends you a vendor security review, or a new contract asks how you protect their data, the answers already exist and every one of them is true. More to the point, the thing you were worried about becomes a great deal less likely to happen at all.