The attacks that actually reach small organisations are rarely clever. They rely on defaults that were never changed and accounts that were never removed.
Turn on multi-factor authentication for email first. Email is the reset route for every other account you own, which makes it the highest-value target you have.
Remove accounts the day someone leaves. Not at the end of the month.
Patch on a schedule you actually keep. A modest monthly window that happens beats an ambitious weekly one that does not.
Back up to somewhere the network cannot reach. Ransomware encrypts every drive it can see, including the one holding your backups.
Give people the least access their job needs. Convenience today is the width of the breach tomorrow.
Change default credentials on routers, switches, cameras and printers. These are the devices attackers scan for, precisely because nobody thinks of them as computers.
Rehearse the response once. Knowing who to call, in what order, saves hours at the moment hours matter most.
securityadvisory
Share this article