Cybersecurity for a small workplace: where to start

Most attacks on small businesses aren't clever. Someone reuses a password, clicks a fake invoice, or leaves an old router running with its default login. The good news is that most of the fixes are simple too. Here's where we'd start, in order.

1. Turn on two-step sign-in everywhere

Two-step sign-in, also called multi-factor authentication or MFA, means a stolen password isn't enough to get in. Start with email, because email is how most other passwords get reset. Then do banking, accounting software, payroll and any remote access to the office.

2. Know who has access to what

Make a list of every account: email, file storage, accounting, the camera app, the door system. Remove anyone who has left. Give admin rights only to the people who need them, and have them use a separate admin account for admin work.

3. Protect your email domain

Without the right settings, anyone can send email that looks like it came from your company. Three DNS records, called SPF, DKIM and DMARC, tell other mail servers which messages really came from you. Microsoft 365 and Google Workspace both support them, but they aren't always set up.

4. Update or replace old equipment

Routers, firewalls, camera recorders and computers all need security updates. Equipment the manufacturer no longer updates should be replaced, because any new hole found in it will never be fixed. Change every default password while you're at it.

5. Keep guests and devices off your main network

Guest Wi-Fi, cameras and smart devices should each sit on their own network. If one of them is compromised, it can't reach your staff computers or your files.

6. Back up, and test the restore

Ransomware locks your files and demands payment. A recent backup kept away from the office network means you can restore instead of paying. A backup you've never restored is a guess, so test one.

7. Teach your team the warning signs

Short, regular reminders work better than a yearly lecture. The big ones: check the sender's address, be suspicious of anything urgent, and always confirm a change to payment details by phone, using a number you already have.

8. Decide what you'll do on a bad day

Write down who to call, how to lock an account and where the backups are. If your business handles personal information and a breach creates a real risk of significant harm, federal privacy law (PIPEDA) generally requires you to report it to the Office of the Privacy Commissioner of Canada and to tell the people affected.

Where we come in

Our security assessment checks all of the above and gives you a written report of what to fix first. We can then make the fixes with you: firewall and Wi-Fi hardening, Microsoft 365 or Google Workspace security, and backups we test by restoring them.

Read about our cybersecurity work or email info@plcsecured.ca.