A security baseline for growing businesses

Most businesses that get breached were not targeted by anyone sophisticated. They were reachable, unpatched and using a password that had already leaked. A baseline that takes weeks, not quarters, removes the overwhelming majority of that risk. This is the order we work in.

Identity first

Almost every incident we are called into starts with a credential. Before anything else:

• Multi-factor authentication everywhere, starting with email, remote access and anything holding customer or financial data. App-based or hardware keys, not SMS where you can avoid it.
• One identity per person, with shared logins removed. "The warehouse account" cannot be audited and never gets its password changed when someone leaves.
• Least privilege. Administrator rights granted by role and reviewed, not handed out permanently because something once did not work.
• A leavers process that actually disables accounts the same day.

Know what you have, then patch it

You cannot protect an inventory you do not have. List the servers, the network devices, the SaaS applications and who owns each one. Then patch on a schedule: operating systems, firmware on firewalls and switches, and the dependencies inside your own applications.

Unsupported software with no upgrade path is a decision, not an accident. Write it down, put a compensating control around it, and set a date.

Segment the network

A flat network means a compromised till, camera or laptop can reach the finance server. Split by function — staff, servers, point of sale, guest wifi, cameras and other devices — and allow only the traffic that has a reason to exist. Remote access belongs behind VPN with MFA, never an RDP port exposed to the internet.

Backups you have restored

A backup nobody has restored is a hypothesis, not a backup.

Keep copies offline or immutable so ransomware cannot encrypt them along with everything else, and schedule a real restore test: pick a system, restore it somewhere isolated, confirm the data is usable, record how long it took. That number is your actual recovery time, and it is usually a surprise the first time.

Logging, alerting and a plan

Collect authentication, firewall and server logs centrally, keep them long enough to investigate with, and alert on the few signals that matter: repeated failed logins, new administrator accounts, disabled security tooling, unusual outbound traffic.

Then write the incident plan on one page: who is called, in what order, who can authorise disconnecting a system, who talks to customers, and where the offline copy of that plan lives. Rehearse it once. The rehearsal always finds a missing phone number.

The people part

Short, specific training beats an annual slide deck: how to spot a payment-detail change request, how to report something suspicious without fear, and why nobody from IT will ever ask for a password. Pair it with technical controls that assume someone will click anyway.

Where to start on Monday

If you do nothing else this quarter: enable MFA on email and remote access, remove shared accounts, get patching on a schedule, and restore one backup end to end. That is a few weeks of work, and it closes the doors that are most often left open.