A client called us last month in a panic. Their email had been “hacked.” When we dug in, the culprit wasn’t a sophisticated zero-day \u2014 it was a password they’d been reusing since 2019. It happens more often than you’d think, and almost all of it is preventable. Here are the five mistakes we see most often with small business clients, and exactly how to fix them.<\/p>\n
You don’t need a six-figure security budget to protect a small business. You need consistent habits. These five are the ones that make the biggest difference.<\/p>\n
The average person reuses passwords across 14 different sites. When one of those sites gets breached (and they do, constantly \u2014 check haveibeenpwned.com<\/a>), every account with that password is instantly at risk.<\/p>\n A password manager like Bitwarden<\/strong> (free, open-source) or 1Password<\/strong> generates a unique, random password for every site and remembers them all. You only remember one master password.<\/p>\n Setup takes about 30 minutes. The ROI is enormous.<\/p>\n MFA means that even if someone has your password, they still can’t log in without a second factor \u2014 usually a 6-digit code from an authenticator app.<\/p>\n Start with your highest-value accounts first: email, banking, and whatever software your business runs on<\/strong>. Microsoft 365 and Google Workspace both support MFA out of the box. Enable it today.<\/p>\n Avoid SMS codes if you can<\/strong> \u2014 SIM-swapping attacks can intercept them. An authenticator app (Google Authenticator, Authy, or a hardware key like a YubiKey) is significantly stronger.<\/p>\n The only backup that matters is the one that works when you need it. The 3-2-1 rule is a simple framework:<\/p>\n For most small businesses this looks like: local copy on your server + cloud backup (BackBlaze B2, AWS S3, or even a second NAS at a different location). Test your restores quarterly.<\/strong> A backup you’ve never restored is a backup you don’t actually have.<\/p>\n The majority of successful attacks exploit known vulnerabilities that already have patches available \u2014 the attackers just know most people won’t apply them. Windows Updates, macOS updates, browser updates, and especially your router firmware.<\/p>\n Set Windows Update to install automatically overnight. If you have staff machines, consider a patch management tool (we use TacticalRMM for our managed clients) so you can confirm every endpoint is current from a single dashboard.<\/p>\n Technical controls only go so far. The most common entry point for ransomware and BEC (Business Email Compromise) attacks is a person clicking a convincing-looking link in an email. A few red flags to train your team on:<\/p>\n Free training tools like Google’s Phishing Quiz<\/strong> are a great starting point for a team training session.<\/p>\n None of this requires expensive software or a dedicated IT team. If your business is in the Pierce County or South King County area and you’d like help implementing any of these \u2014 or want us to run a security baseline check on your current setup \u2014 reach out to us<\/a>. We’re happy to take a look.<\/p>\n Thanks!<\/p>\n","protected":false},"excerpt":{"rendered":" Five practical cybersecurity habits that small businesses can implement today \u2014 no big budget required. Password managers, MFA, the 3-2-1 backup rule, patching, and phishing awareness.<\/p>\n","protected":false},"author":2,"featured_media":1322,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,6,8],"tags":[],"series":[66],"class_list":["post-210","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-best-practices","category-cybersecurity","category-managed-it-services","series-saturday-morning-coffee"],"_links":{"self":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/comments?post=210"}],"version-history":[{"count":4,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/210\/revisions"}],"predecessor-version":[{"id":1330,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/posts\/210\/revisions\/1330"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/media\/1322"}],"wp:attachment":[{"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/media?parent=210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/categories?post=210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/tags?post=210"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/rainier-it.com\/blog\/wp-json\/wp\/v2\/series?post=210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}2. Turn On Multi-Factor Authentication Everywhere<\/h2>\n
3. Follow the 3-2-1 Backup Rule<\/h2>\n
\n
4. Keep Everything Patched<\/h2>\n
5. Train Your Team to Spot Phishing<\/h2>\n
\n
micros0ft.com<\/code>, paypa1.com<\/code>)<\/li>\n<\/ul>\n
\n