When a business
owner books a discovery call with me, they usually expect a pitch for new
software. That's not where I start. Before Argentum IT recommends or quotes
anything, I want to know whether the basics are actually in place, because the
gaps I look for first rarely cost anything to close.
That's the myth
worth retiring this month: that real cybersecurity starts with a big purchase.
Much of the risk I see in small and mid-sized businesses comes from settings
that were never turned on, accounts nobody cleaned up, and backups nobody has
tested.
Here are the
six things I check first, and what you can do about each one this week without
a budget request.
1. Multi-factor authentication on everything that matters
If I could
change only one thing in your business, this would be it. Multi-factor
authentication (MFA) means a password alone isn't enough to get in. You also
need a code from an app, a security key, or a fingerprint. If someone steals or
guesses a password, they're still stuck at the door.
Turn it on
first for:
•
Microsoft 365 or Google Workspace (your email is where
password resets land for everything else)
•
Banking and payroll applications
•
Cloud storage
•
VPN and remote access
•
The line-of-business applications you can't run without
Almost all of these include MFA at no extra
cost. One piece of advice: where you have a choice, use an authenticator app
instead of text-message codes. Text codes are far better than nothing, but
they're easier to intercept.
2. Accounts for people who don't work with you anymore
Former
employees. The contractor from the website project two years ago. The vendor
you switched away from. Their accounts often stay live because nobody owns the
job of turning them off, and attackers like them precisely because nobody
notices when they're used.
Walk through
your user list and ask three questions of every account:
•
Does this person still work with us?
•
Does this account still serve a business purpose?
•
Does it have more access than the job requires?
Any "no" means adjust it or remove
it. Better yet, make it a checklist item for someone's last day. That's why we
build custom onboarding and offboarding forms for our clients: account cleanup
should be a process, not a memory test.
3. Admin rights handed out for convenience
Admin rights
usually get granted because someone needed to install a printer driver once.
That shortcut is expensive. An admin account can install software, change
settings, and switch off your security tools, so when one is compromised, the
attacker gets all of that too.
In the Army,
access followed the job, not convenience. You got what the mission required and
nothing more. Apply the same rule here:
•
Does this person need admin rights to do their job
every day?
•
Is there a lower access level in the tool that fits
their role?
•
Could admin tasks run from a separate account used only
for that purpose?
Pull admin rights wherever the answer is no.
4. Updates that aren't actually automatic
Attackers go
after software with known, published weaknesses, because the fix already exists
and plenty of businesses haven't installed it. Confirm automatic updates are
really on for:
•
Windows and macOS
•
Phones and tablets
•
Web browsers
•
Microsoft Office
•
Antivirus software
•
Key business applications
Don't just check the setting. Check back in a
few weeks to confirm updates are actually installing. A computer that never
restarts can sit on a pending update for a long time.
5. Passwords living in people's heads (or on sticky notes)
Asking
employees to remember a strong, unique password for dozens of accounts isn't a
security policy. It's a guarantee of password reuse. A password manager fixes
the math. It helps your team:
•
Create strong passwords
•
Store them securely
•
Stop reusing the same password across accounts
•
Share credentials safely instead of over email or text
Several reputable password managers offer
free or low-cost tiers. The fewer passwords people have to remember, the less
likely they are to fall back on weak ones.
6. Backups nobody has tested
A backup you've
never restored from is a hope, not a plan. Ask your team:
•
When did our last successful backup run?
•
When did anyone last restore an actual file, not just
glance at a green checkmark?
•
How long would it take to get back to work if our main
system went down today?
If nobody can answer the second question, fix
that one first. Every other recovery step in your incident response plan
depends on it.
Free doesn't mean finished
None of these
six fixes costs money. What they cost is attention. Someone has to own them and
keep them in place after this week. That's where most businesses slip, and it's
rarely for lack of caring. It's that nobody's job description says "review
the admin list every quarter."
If you'd like a
second set of eyes, that's what our discovery call is for. It takes 15 minutes.
I'll ask plain-English questions about how your business runs, and you'll leave
knowing which of these gaps matter most for you and what to do next. We don't quote
fixed-scope work sight-unseen, and I won't try to sell you a tool to solve a
problem a free setting can fix.
Schedule a 15-minute discovery call with Argentum
IT, serving businesses across Louisville and Southern Indiana.
Dean Lause | CEO, Argentum IT
Argentum IT — Veteran Owned
and Run
