Start with the accounts attackers want most
Begin with the accounts that can unlock other systems or move money: email, banking, payroll, bookkeeping, domain registration, website hosting, cloud storage, and administrator accounts. If one of these is taken over, an attacker may reset other passwords, impersonate you, change payment instructions, or disrupt your online presence. Make a simple inventory of who has access, what level of access they need, and how each account can be recovered.
Use unique passwords for every important service and store them in a reputable password manager rather than a spreadsheet or browser note. Turn on multifactor authentication wherever it is available, prioritizing email, financial services, administrator accounts, and remote access. Review old users, former vendors, shared logins, and unused administrator profiles. Removing access that no longer has a business reason is one of the simplest ways to reduce exposure.
- List critical accounts and their owners
- Prioritize multifactor authentication for email and money-related systems
- Remove unused users and unnecessary administrator privileges
Treat phishing, credential stuffing, and invoice fraud as connected risks
Phishing is not limited to obviously strange emails. A message can imitate a known supplier, request a password reset, or create urgency around a document or payment. Credential stuffing is different but related: attackers try usernames and passwords exposed elsewhere against your accounts. Password reuse gives both attacks more room to succeed, especially when employees manage several cloud services.
Invoice fraud often begins with mailbox access or convincing impersonation rather than a technical attack on your bank. Establish a rule that payment details, wire instructions, and new vendors must be verified through a second trusted channel. Do not use the phone number or reply address in the suspicious message. Make the process easy enough that employees will follow it when a request appears urgent.
- Verify payment changes through a known phone number or separate conversation
- Teach employees to report suspicious messages without fear of blame
- Use unique passwords so one exposed credential does not unlock several services
Build layers around email, devices, and access
Email is a major starting point for business compromise, so protection should include both technology and judgment. Keep mailboxes on supported services, require stronger sign-in for sensitive accounts, and review forwarding rules for unexpected changes. Domain email authentication can also help receiving systems distinguish legitimate messages from messages that claim to come from your domain; SPF, DKIM, and DMARC should be considered as part of a broader email review.
On computers and phones, keep operating systems, browsers, business applications, and security tools updated. Limit local administrator access where practical, lock screens, and separate personal accounts from business administration. For remote work, secure home routers and avoid conducting sensitive work on unknown public networks. These steps do not eliminate risk, but they make a single mistake less likely to become broad access.
- Review mailbox forwarding and sign-in activity
- Keep operating systems and applications supported and updated
- Separate everyday work accounts from administrator accounts
Prepare for ransomware without assuming recovery is automatic
Ransomware can affect availability even when an attacker does not steal every file. A practical plan starts by identifying which systems the business must restore first, who can make decisions, and how employees should communicate if email is unavailable. Write down vendor contacts, domain and hosting details, key software subscriptions, and recovery steps somewhere accessible during an account outage.
Backups need attention beyond their existence. Protect backup accounts with strong credentials and multifactor authentication, keep an appropriate copy separated from everyday systems, and periodically confirm that important files can actually be restored. The 3-2-1 backup rule is a useful planning framework: maintain three copies of data, on two types of media, with one copy kept offsite. The right implementation depends on the systems and data your business uses.
- Identify the systems and files that must be restored first
- Keep recovery contacts and procedures available during an outage
- Test restoration instead of assuming a backup is usable
Turn security into a manageable operating routine
A one-time cleanup helps, but security improves when someone owns the follow-through. Set a recurring review for user access, software updates, administrator accounts, mailbox rules, domain settings, backup status, and unusual sign-in activity. Keep a short record of what was checked, what changed, and what still needs a decision. This creates useful continuity when your business grows or a contractor changes.
Your plan should match your actual risks, budget, and capacity. A small professional office may need different controls from a contractor handling plans, a retailer processing payments, or a service company relying on shared cloud documents. I can help separate urgent fixes from worthwhile later improvements, explain the tradeoffs in plain English, and leave you with ownership of your code, hosting, domains, and accounts.
- Assign an owner for recurring security reviews
- Keep a current list of vendors, systems, and recovery contacts
- Rank fixes by business impact rather than by fear or complexity